Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Summary

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Timeline

1. Jun 30, 2026, 1:02 PM UTCCVE published
2. Jul 1, 2026, 2:27 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 30, 2026, 7:43 AM UTCRecord last updated

Affected versions

• GLib

  fixed in 2.88.1

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• mingw-glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• glib2

  Version range not reported

• rhcos

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhaii/vllm-rocm-rhel9

  Version range not reported

• rhaii/vllm-gaudi-rhel9

  Version range not reported

• rhaii/model-opt-cuda-rhel9

  Version range not reported

• rhaii/vllm-cuda-rhel9

  Version range not reported

• rhaii/vllm-spyre-rhel9

  Version range not reported

• rhaii/vllm-cpu-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• rhelai3/disk-image-cuda-rhel9

  Version range not reported

• rhelai3/bootc-aws-cuda-rhel9

  Version range not reported

• rhelai3/bootc-azure-cuda-rhel9

  Version range not reported

• rhelai3/bootc-azure-rocm-rhel9

  Version range not reported

• rhelai3/bootc-cuda-rhel9

  Version range not reported

• rhelai3/bootc-gcp-cuda-rhel9

  Version range not reported

• rhelai3/bootc-rocm-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhai/base-image-rocm-7.1-rhel9

  Version range not reported

• rhai/base-image-rocm-6.4-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-rubin-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-7.14-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• rhui5/cds-kubernetes-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• mingw-glib2

  Version range not reported

• glib2

  Version range not reported

• mingw-glib2

  Version range not reported

• glib2

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 25