Skip to main content

haveged CVE-2026-41054

| EUVDEUVD-2026-31076 HIGH
Authentication Bypass by Primary Weakness (CWE-305)
2026-05-20 GHSA-c5g3-m8p9-m3gh
Privilege Escalation
7.8
CVSS 3.1 · Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged shell
  2. Delivery
    Locate haveged command socket
  3. Exploit
    Connect without authentication (CWE-305)
  4. Execution
    Issue privileged command to root daemon
  5. Impact
    Escalate to root on host

Vulnerability Assessment

Weakness
CWE
CWE-305
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Primary weakness mitigation
Exploitation Conditions

Exploitation requires local access to the target host with an interactive or scripted low-privileged account (PR:L) and the haveged daemon installed and running with its command socket reachable by that account; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors are that the attack vector is local-only (AV:L) so remote network exploitation is not in scope, the attacker must already have code execution as some non-root principal on the box, and the host must be running a vulnerable haveged build - systems that have removed haveged in favor of kernel-native jitterentropy, or that already restrict the command socket via filesystem ACLs or MAC policy, are not exposed.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H gives 7.8 (High): exploitation requires local access and a low-privilege account but no user interaction, and yields full confidentiality, integrity, and availability impact - consistent with a clean local privilege escalation. The vulnerability is not listed in CISA KEV, EPSS is not provided in the input, and no public exploit identified at time of analysis, so this is not in the same urgency tier as remote unauthenticated RCEs but is significant on multi-user systems (servers, shared hosts, containers escaping to host namespaces) where any unprivileged compromise pivots straight to root. SUSE has already issued SUSE-SU-2026:2008 and SUSE-SU-2026:2009 and Debian is tracking the bug, indicating the issue is confirmed by multiple distributions; no EPSS or KEV signal is available to refine the likelihood estimate, so prioritization should be driven by exposure (number of multi-tenant Linux hosts running haveged) rather than by mass-exploitation probability.
Exploit ScenarioDerived

A local attacker who has obtained an unprivileged shell on a Linux host - for example through a web-app foothold, a stolen SSH key for a service account, or a container break-in that lands in the host user namespace - connects to the haveged command socket and issues a privileged command that the daemon executes without authenticating the caller. Because haveged runs as root, the attacker leverages that command channel to read/write privileged state or otherwise pivot to a root-equivalent context, completing a local privilege escalation on a default install of an affected package; no public exploit identified at time of analysis, but the bug class is straightforward to weaponize once the socket protocol is understood.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Local privilege escalation in haveged (HArdware Volatile Entropy Gathering and Expansion Daemon) allows authenticated low-privileged users to escalate to root via the daemon's command socket, which is affected by missing authentication for a critical function (CWE-305). The flaw was disclosed on the oss-security mailing list on 2026-05-20 by Jiri Hladky, with vendor patches available from SUSE and tracking in Debian (bug#1137096); no public exploit identified at time of analysis.

RemediationAI

Apply the vendor-released haveged packages: SUSE users should install the updates referenced in SUSE-SU-2026:2008 (https://www.suse.com/support/update/SUSE-SU-2026:2008/) and SUSE-SU-2026:2009 (https://www.suse.com/support/update/SUSE-SU-2026:2009/), and Debian users should track and install the fix from bug#1137096 once their release receives it; other distributions should pull the corresponding rebuilt package referenced by the upstream oss-security disclosure at https://www.openwall.com/lists/oss-security/2026/05/20. Exact fixed upstream version numbers were not provided in the input data, so administrators should pin to the package version named in their distribution advisory rather than an invented release tag. If patching must be deferred, compensating controls include stopping the haveged service on hosts where modern kernels (5.6+) already provide jitterentropy and haveged is redundant (trade-off: re-evaluate entropy posture on older kernels or FIPS-constrained systems), or tightening filesystem permissions and SELinux/AppArmor policy around the haveged command socket to deny access from non-root UIDs (trade-off: may break legitimate management tooling that talks to the socket).

Affected VersionsENISA

SUSE Manager Proxy LTS 4.3 ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6 ? <1.9.14-150600.11.6.1
Image SLES15-SP4-SAP-BYOS ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Desktop 15 SP7 ? <1.9.14-150600.11.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server 15 SP7 ? <1.9.14-150600.11.6.1
SUSE Linux Enterprise Module for Basesystem 15 SP7 ? <1.9.14-150600.11.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened-BYOS-GCE ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server for SAP Applications 15 SP7 ? <1.9.14-150600.11.6.1
Container suse/sle-micro-rancher/5.4:latest ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened-BYOS-EC2 ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server 15 SP6-LTSS ? <1.9.14-150600.11.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise High Performance Computing 15 SP7 ? <1.9.14-150600.11.6.1
SUSE Manager Server LTS 4.3 ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Micro 5.4 ? <1.9.14-150400.3.11.1
SUSE Manager Retail Branch Server LTS 4.3 ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened-BYOS-Azure ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Micro 5.3 ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened-GCE ? <1.9.14-150400.3.11.1
Container suse/sle-micro/5.5:latest ? <1.9.14-150400.3.11.1
Container suse/sle-micro-rancher/5.3:latest ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-BYOS-GCE ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Micro 5.5 ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-Hardened-BYOS ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-BYOS-Azure ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5 ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS ? <1.9.14-150400.3.11.1
Image SLES15-SP4-SAP-BYOS-EC2 ? <1.9.14-150400.3.11.1
SUSE Linux Enterprise Server 15 SP5-LTSS ? <1.9.14-150400.3.11.1

Affected Packages

euvd container_suse_sle_micro_5_5_latest fix: 1.9.14-150400.3.11.1
euvd container_suse_sle_micro_rancher_5_3_latest fix: 1.9.14-150400.3.11.1
euvd container_suse_sle_micro_rancher_5_4_latest fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_byos fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_byos_azure fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_byos_ec2 fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_byos_gce fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened_byos fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened_byos_azure fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened_byos_ec2 fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened_byos_gce fix: 1.9.14-150400.3.11.1
euvd image_sles15_sp4_sap_hardened_gce fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_desktop_15_sp7 fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_high_performance_computing_15_sp4_espos fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_high_performance_computing_15_sp4_ltss fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_high_performance_computing_15_sp5_espos fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_high_performance_computing_15_sp5_ltss fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_high_performance_computing_15_sp7 fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_micro_5_3 fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_micro_5_4 fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_micro_5_5 fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_module_for_basesystem_15_sp7 fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_server_15_sp4_ltss fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_server_15_sp5_ltss fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_server_15_sp6_ltss fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_server_15_sp7 fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_server_for_sap_applications_15_sp4 fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_server_for_sap_applications_15_sp5 fix: 1.9.14-150400.3.11.1
euvd suse_linux_enterprise_server_for_sap_applications_15_sp6 fix: 1.9.14-150600.11.6.1
euvd suse_linux_enterprise_server_for_sap_applications_15_sp7 fix: 1.9.14-150600.11.6.1
euvd suse_manager_proxy_lts_4_3 fix: 1.9.14-150400.3.11.1
euvd suse_manager_retail_branch_server_lts_4_3 fix: 1.9.14-150400.3.11.1
euvd suse_manager_server_lts_4_3 fix: 1.9.14-150400.3.11.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 34 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

haveged is an entropy-gathering daemon used on Linux systems to feed /dev/random with high-quality randomness by harvesting hardware volatile state via the HAVEGE algorithm. The daemon exposes a local command socket for runtime control, and the root cause is mapped to CWE-305 (Authentication Bypass by Primary Weakness / Missing Authentication for Critical Function), meaning the socket does not properly authenticate the caller before honoring privileged commands. Because haveged typically runs as root to write to kernel entropy interfaces, any command-channel weakness becomes a direct path from a local foothold to full root.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
CVSS changed
May 20, 2026 - 10:22 NVD
7.8 (HIGH)
CVE Published
May 20, 2026 - 00:45 nvd
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

haveged, a hardware entropy daemon running on Linux systems, contains a local privilege escalation vulnerability allowing authenticated users to gain root access. Organizations with multi-user systems or SSH-enabled environments face immediate risk of complete system compromise and lateral movement.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-305 – Authentication Bypass by Primary Weakness

View all
CVE-2025-31161 CRITICAL POC
9.8
CVE-2026-81578 HIGH POC
8.8
CVE-2024-50478 CRITICAL
9.8
CVE-2023-34124 CRITICAL POC
9.8
CVE-2023-1307 CRITICAL POC
9.8
CVE-2023-0777 CRITICAL POC
9.8
CVE-2022-2651 CRITICAL POC
9.8
CVE-2026-25555 CRITICAL POC
9.3

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

Debian

Bug #1137096
haveged
Release Status Fixed Version Urgency
bookworm, bullseye vulnerable 1.9.14-1 -
trixie vulnerable 1.9.19-12 -
forky vulnerable 1.9.20-1 -
sid fixed 1.9.21-1 -
(unstable) fixed 1.9.21-1 -

SUSE

Severity: High
Product Status
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Container suse/sle-micro/5.5:latest Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41054 ADVISORY https://vuldb.com/vuln/364839 ADVISORY https://www.openwall.com/lists/oss-security/2026/05/20 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2008/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2009/ REF http://www.openwall.com/lists/oss-security/2026/05/19/3 REF http://www.openwall.com/lists/oss-security/2026/05/19/4 REF http://www.openwall.com/lists/oss-security/2026/05/19/5 REF http://www.openwall.com/lists/oss-security/2026/05/20/1 REF http://www.openwall.com/lists/oss-security/2026/05/21/17 REF http://www.openwall.com/lists/oss-security/2026/05/22/1 REF https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054 REF https://lists.debian.org/debian-lts-announce/2026/06/msg00005.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy