CVE-2026-58015
published 2026-06-30CVE-2026-58015: A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context…
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.84%
57.6th percentile
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | glib | < 2.88.1 | 2.88.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | glib2.0 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in GLib.
ghsa_unreviewed·2026-06-30
CVE-2026-58015 [MEDIUM] A flaw was found in GLib.
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
VulDB
GNOME GLib up to 2.88.0 cookie_context path traversal (ID 3931 / EUVD-2026-40318)
vuldb·2026-06-30·CVSS 5.9
CVE-2026-58015 [MEDIUM] GNOME GLib up to 2.88.0 cookie_context path traversal (ID 3931 / EUVD-2026-40318)
A vulnerability, which was classified as critical, has been found in GNOME GLib up to 2.88.0. This issue affects some unknown processing. This manipulation of the argument cookie_context causes path traversal.
This vulnerability is handled as CVE-2026-58015. The attack can be initiated remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
Ubuntu
GLib vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 5.3
CVE-2026-58013 [MEDIUM] GLib vulnerabilities
Title: GLib vulnerabilities
Summary: GLib could be made to crash or expose sensitive information if it
received specially crafted input.
It was discovered that GLib's GDBus authentication mechanism failed to
enforce length limitations on data lines read from a client. An
unauthenticated attacker could exploit this to cause a denial of service
via resource exhaustion. (CVE-2026-15588)
It was discovered that the xdgmime library in GLib had a heap-based
buffer overflow. An attacker-controlled MIME magic file could cause an
out-of-bounds write on little-endian systems. (CVE-2026-16118)
It was discovered that GLib had an off-by-one error in the GVariant
serialiser. An attacker could use this to cause an out-of-bounds read,
leading to information disclosure or a denial of service.
(CVE-2026-
Red Hat
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
vendor_redhat·2026-04-08·CVSS 5.9
CVE-2026-58015 [MEDIUM] glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
Statement: To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
bugzilla·2026-06-30·CVSS 5.9
CVE-2026-58015 [MEDIUM] CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The GLib D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem path v
Bugzilla
CVE-2026-58015 mingw-glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
bugzilla·2026-06-30·CVSS 5.9
CVE-2026-58015 [MEDIUM] CVE-2026-58015 mingw-glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
CVE-2026-58015 mingw-glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The GLib D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem
Bugzilla
CVE-2026-58015 glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
bugzilla·2026-06-30·CVSS 5.9
CVE-2026-58015 [MEDIUM] CVE-2026-58015 glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
CVE-2026-58015 glib2: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The GLib D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem path
Bugzilla
CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
bugzilla·2026-06-24·CVSS 5.9
CVE-2026-58015 [MEDIUM] CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
CVE-2026-58015 glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
The GLib D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. The D-Bus specification explicitly states that cookie context names must not contain the characters /, \, . (period), spaces, or ASCII control characters. However, GLib's client-side code accepts this value verbatim and uses it to construct a filesystem path via g_build_filename(). A malicious D-Bus server can supply a cookie_context containing path traversal sequences such as ../.target_file, causing the client to read an arbitrary file outside the ~/.dbus-keyrings/ directory. The file conten
https://access.redhat.com/errata/RHSA-2026:49512https://access.redhat.com/errata/RHSA-2026:55440https://access.redhat.com/errata/RHSA-2026:57015https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/errata/RHSA-2026:61766https://access.redhat.com/errata/RHSA-2026:61783https://access.redhat.com/errata/RHSA-2026:63135https://access.redhat.com/errata/RHSA-2026:63138https://access.redhat.com/errata/RHSA-2026:63140https://access.redhat.com/errata/RHSA-2026:65762https://access.redhat.com/errata/RHSA-2026:65763https://access.redhat.com/errata/RHSA-2026:65767https://access.redhat.com/errata/RHSA-2026:65768https://access.redhat.com/errata/RHSA-2026:65769https://access.redhat.com/errata/RHSA-2026:65770https://access.redhat.com/errata/RHSA-2026:65771https://access.redhat.com/errata/RHSA-2026:65773https://access.redhat.com/errata/RHSA-2026:66018https://access.redhat.com/errata/RHSA-2026:66357https://access.redhat.com/errata/RHSA-2026:70646https://access.redhat.com/errata/RHSA-2026:72394https://access.redhat.com/errata/RHSA-2026:72395https://access.redhat.com/errata/RHSA-2026:72399https://access.redhat.com/errata/RHSA-2026:72470https://access.redhat.com/errata/RHSA-2026:72475https://access.redhat.com/errata/RHSA-2026:72476https://access.redhat.com/errata/RHSA-2026:72502https://access.redhat.com/errata/RHSA-2026:73859https://access.redhat.com/errata/RHSA-2026:73866https://access.redhat.com/errata/RHSA-2026:73909https://access.redhat.com/errata/RHSA-2026:73929https://access.redhat.com/errata/RHSA-2026:73930https://access.redhat.com/errata/RHSA-2026:73959https://access.redhat.com/errata/RHSA-2026:73960https://access.redhat.com/errata/RHSA-2026:73961https://access.redhat.com/errata/RHSA-2026:73962https://access.redhat.com/errata/RHSA-2026:74458https://access.redhat.com/errata/RHSA-2026:74459https://access.redhat.com/errata/RHSA-2026:74460https://access.redhat.com/errata/RHSA-2026:74461https://access.redhat.com/errata/RHSA-2026:74462https://access.redhat.com/errata/RHSA-2026:74463https://access.redhat.com/errata/RHSA-2026:74674https://access.redhat.com/errata/RHSA-2026:74677https://access.redhat.com/errata/RHSA-2026:74678https://access.redhat.com/errata/RHSA-2026:74679https://access.redhat.com/errata/RHSA-2026:74681https://access.redhat.com/errata/RHSA-2026:74683https://access.redhat.com/errata/RHSA-2026:74685https://access.redhat.com/errata/RHSA-2026:74687https://access.redhat.com/errata/RHSA-2026:74688https://access.redhat.com/errata/RHSA-2026:74771https://access.redhat.com/errata/RHSA-2026:75652https://access.redhat.com/errata/RHSA-2026:75654https://access.redhat.com/errata/RHSA-2026:75655https://access.redhat.com/errata/RHSA-2026:75657https://access.redhat.com/errata/RHSA-2026:75658https://access.redhat.com/errata/RHSA-2026:75659https://access.redhat.com/errata/RHSA-2026:75660https://access.redhat.com/errata/RHSA-2026:76042https://access.redhat.com/errata/RHSA-2026:77320https://access.redhat.com/errata/RHSA-2026:80769https://access.redhat.com/errata/RHSA-2026:80771https://access.redhat.com/errata/RHSA-2026:82059https://access.redhat.com/errata/RHSA-2026:82061https://access.redhat.com/errata/RHSA-2026:82066https://access.redhat.com/errata/RHSA-2026:82304https://access.redhat.com/errata/RHSA-2026:82322https://access.redhat.com/errata/RHSA-2026:82336https://access.redhat.com/errata/RHSA-2026:82347https://access.redhat.com/errata/RHSA-2026:82354https://access.redhat.com/errata/RHSA-2026:82368https://access.redhat.com/errata/RHSA-2026:82371https://access.redhat.com/errata/RHSA-2026:82372https://access.redhat.com/errata/RHSA-2026:82415https://access.redhat.com/errata/RHSA-2026:82811https://access.redhat.com/errata/RHSA-2026:82857https://access.redhat.com/errata/RHSA-2026:82888https://access.redhat.com/security/cve/CVE-2026-58015https://bugzilla.redhat.com/show_bug.cgi?id=2492256https://gitlab.gnome.org/GNOME/glib/-/issues/3931
2026-06-30
Published