What is the CVSS score of CVE-2026-41054?

CVE-2026-41054 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of haveged are affected by CVE-2026-41054?

haveged, a hardware entropy daemon running on Linux systems, contains a local privilege escalation vulnerability allowing authenticated users to gain root access.. A patch is available.

haveged CVE-2026-41054

EUVD-2026-31076 HIGH

Authentication Bypass by Primary Weakness (CWE-305)

2026-05-20

GHSA-c5g3-m8p9-m3gh

Privilege Escalation

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 10:22 vuln.today

CVSS changed

May 20, 2026 - 10:22 NVD

7.8 (HIGH)

CVE Published

May 20, 2026 - 00:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Local privilege escalation in haveged (HArdware Volatile Entropy Gathering and Expansion Daemon) allows authenticated low-privileged users to escalate to root via the daemon's command socket, which is affected by missing authentication for a critical function (CWE-305). The flaw was disclosed on the oss-security mailing list on 2026-05-20 by Jiri Hladky, with vendor patches available from SUSE and tracking in Debian (bug#1137096); no public exploit identified at time of analysis.

RemediationAI

Within 24 hours: inventory systems running haveged and assess local user access policies. Within 7 days: apply vendor patches from SUSE or Debian and restart the haveged service. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Vendor StatusVendor

Debian

Bug #1137096

haveged

Release	Status	Fixed Version	Urgency
bookworm, bullseye	vulnerable	1.9.14-1	-
trixie	vulnerable	1.9.19-12	-
forky	vulnerable	1.9.20-1	-
sid	fixed	1.9.21-1	-
(unstable)	fixed	1.9.21-1	-

CVE-2026-41054 vulnerability details – vuln.today

Back

haveged CVE-2026-41054

CVSS VectorNVD

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Vendor StatusVendor

Debian

Share

External POC / Exploit Code