Clevis CVE-2026-109971

Exploitation requires that the host actually uses the clevis PKCS#11 pin (clevis-decrypt-pkcs11), that a decryption operation invoking pkcs11-tool occurs while the attacker is present, and that the attacker is an already-logged-in local user able to read the process table or /proc/<pid>/cmdline. Limiting factors: no remote vector (local access only), authenticated low-privileged access needed, the PKCS#11 pin must be configured (a non-default, specialized clevis binding rather than the common Tang/TPM2 pins), and the attacker must win a timing race against the short-lived pkcs11-tool process, which is why attack complexity is high.

This is a genuine but low-urgency issue. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7/Medium) tells a consistent story: exploitation requires local access (AV:L), an already-authenticated low-privileged user (PR:L), and high attack complexity (AC:H) because the attacker must observe the process table or /proc during the brief window in which clevis-decrypt-pkcs11 invokes pkcs11-tool. No EPSS score, SSVC decision, KEV listing, or POC reference was supplied in the input, so exploitation-probability and automatability signals are simply absent rather than conflicting - their absence should not be read as low risk, but nothing here elevates it either. There is no public exploit identified at time of analysis and no evidence of active exploitation. The one notable tension is that the impact is rated C:H despite the flaw being pure information disclosure (CWE-214) of a PKCS#11 token PIN: C:H is defensible because the leaked PIN can unlock the cryptographic token and thus the data it protects, but defenders should recognize that the direct bug only discloses a secret rather than granting code execution. Net: a real defect worth patching during normal maintenance, not an emergency, given the local-only, timing-dependent, authenticated prerequisites.

A local unprivileged user with shell access on a RHEL or OpenShift host that uses the clevis PKCS#11 pin repeatedly samples the process listing (ps) or reads /proc/<pid>/cmdline while an automated LUKS/clevis decryption runs, capturing the PKCS#11 token PIN passed as a command-line argument to pkcs11-tool. The attacker then reuses that PIN to unlock the token and access the protected key material. No public exploit is identified, and the high attack complexity reflects the need to race the short-lived invocation window.