PackageKit CVE-2026-10294

Exploitation requires low-privilege authenticated access to the PackageKit API (confirmed by CVSS PR:L). The attacker must be able to submit a transaction request with a controlled frontend-socket argument to the pk-transaction.c API component - this is the specific triggering condition. The attack is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). Exploitation is limited by the PR:L authentication requirement: unauthenticated attackers cannot exploit this without first obtaining at least a low-privilege account or session. Impact is further limited to confidentiality (C:L) with no integrity or availability consequences. The scope is unchanged (S:U), meaning the vulnerability cannot be leveraged to compromise components outside PackageKit's trust boundary. No special non-default configuration was described as required beyond having PackageKit deployed with its API accessible.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N yields a base score of 4.3, reflecting a medium-low severity: network-reachable, low complexity, requires low-privilege authentication, no user interaction, no integrity or availability impact, and limited confidentiality exposure. The temporal modifiers (E:P for proof-of-concept, RL:X for no remediation level confirmed, RC:R for reasonable but unconfirmed confidence) marginally adjust the score but confirm active POC existence. There is no CISA KEV entry, so confirmed active exploitation cannot be stated. EPSS data was not provided, preventing probability-of-exploitation comparison. The PR:L requirement meaningfully limits the attack surface - unauthenticated exploitation is not supported by the CVSS vector. The scope is unchanged (S:U), meaning the vulnerability cannot be used to pivot beyond PackageKit's security boundary per CVSS modeling. Overall, this is a real but bounded risk: the POC lowers exploitation bar for accounts with any PackageKit API access, but the confidentiality-only impact and authenticated precondition limit blast radius.

An attacker with a low-privileged account on a system or network segment with access to the PackageKit D-Bus API submits a crafted transaction request with a manipulated frontend-socket argument. The g_file_test authorization check in pk-transaction.c fails to correctly reject the request, allowing the attacker to read confidential package state information they would not ordinarily be authorized to access. A publicly available proof-of-concept at https://github.com/PackageKit/PackageKit/issues/969 demonstrates this bypass, lowering the skill threshold for exploitation.