CVE-2026-4105
published 2026-03-13CVE-2026-4105: A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class…
medium6.7CVSS 3.1
AVLACHPRLUIRSUCHIHAH
A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | systemd | < systemd 260~rc3-1 (forky) | systemd 260~rc3-1 (forky) |
| msrc | azl3_systemd-bootstrap_250.3-18_on_azure_linux_3.0 | — | — |
| msrc | azl3_systemd_255-26_on_azure_linux_3.0 | — | — |
| msrc | cbl2_systemd-bootstrap_250.3-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_systemd_250.3-23_on_cbl_mariner_2.0 | — | — |
| systemd_project | systemd | >= 0 < 260~rc3-1 | 260~rc3-1 |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
osv6.7MEDIUM