Skip to main content

systemd-machined CVE-2026-15060

| EUVDEUVD-2026-55627 MEDIUM
Improper Access Control (CWE-284)
2026-08-10 systemd
Authentication Bypass Systemd Systemd Machined
4.7
CVSS 3.1 · Vendor: systemd
Share

Severity by source

Vendor (systemd) PRIMARY
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Local graphical-session requirement enforces AV:L and AC:H; low-privileged authenticated user (PR:L); impact is process termination only, yielding A:H with no confidentiality or integrity consequences.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (systemd).

CVSS VectorVendor: systemd

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Aug 10, 2026 - 15:02 EUVD
Analysis Generated
Aug 10, 2026 - 14:06 vuln.today

DescriptionCVE.org

When systemd-machined >= v259 (or v258 with a custom polkit policy that allows register-machine access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.

  • versions older than v259 are not affected, unless unprivileged access is granted for the register-machine polkit action via a local, custom policy config file
  • versions older than v258 are not affected
  • unrelated to the systemd service manager (pid 1 or user session managers)
  • systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container)
  • terminal-only or remote sessions (e.g.: ssh) are not affected

AnalysisAI

Process termination via systemd-machined v259 and later enables unprivileged users with active desktop graphical sessions to kill arbitrary system processes, including those running with elevated privileges, by exploiting an improper access control gap in the register-machine polkit action. The affected component - systemd-machined - is typically distributed as an optional, non-default package (such as systemd-container), and exploitation is strictly limited to desktop graphical login sessions, ruling out remote and SSH-based attack vectors entirely. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.

Technical ContextAI

systemd-machined is the systemd subsystem responsible for tracking and managing virtual machines and containers; it is explicitly distinct from the core systemd service manager (PID 1) and user session managers. The vulnerability is rooted in CWE-284 (Improper Access Control): starting with v259, the default polkit policy for the register-machine action permits unprivileged users in graphical sessions to interact with systemd-machined in a way that improperly confers the ability to send termination signals to arbitrary processes, including privileged ones, beyond what is authorized for that user. In v258, the same flaw is reachable only if a local administrator has deployed a custom polkit policy file granting register-machine access to unprivileged users - a non-default configuration. The affected CPE is cpe:2.3:a:systemd:systemd-machined:*:*:*:*:*:*:*:*, scoped specifically to the machined daemon and not the broader systemd init infrastructure. The polkit D-Bus interface is the attack surface, and the flaw lies in the access enforcement layer that fails to constrain signal-delivery capability after machine registration is permitted.

RemediationAI

The primary fix is to upgrade systemd-machined to a patched version as documented in the upstream advisory at https://github.com/systemd/systemd/security/advisories/GHSA-qwv4-3gwc-w5g8; the exact fixed release version is not independently confirmed from the available input data and should be verified from that advisory before deployment. Where an immediate update is not feasible, the most effective compensating control is to remove the systemd-container package (or equivalent) entirely if container and VM lifecycle management via systemd-machined is not operationally required - this eliminates the attack surface with no impact on non-container workloads. On systems where systemd-machined is necessary, administrators should audit and restrict the register-machine polkit action in /etc/polkit-1/ policy files to prevent unprivileged user invocation; note that tightening this policy may break graphical-session container management workflows for desktop users and should be tested before enforcement. As an additional depth-of-defense measure on affected desktop environments, restricting graphical session access to only operationally necessary accounts reduces the pool of potential local attackers.

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV
CVE-2022-2526 CRITICAL
9.8 Sep 09

A use-after-free vulnerability was found in systemd. Rated critical severity (CVSS 9.8), this vulnerability is remotely

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

Share

CVE-2026-15060 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy