Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain unprivileged local shell on RHEL/OpenShift host
  2. Delivery
    Identify privileged setcap workflow targeting writable parent directory
  3. Exploit
    Race cap_set_file() path-check via rename/symlink swap
  4. Execution
    Capability xattr written to attacker-controlled binary
  5. Persist
    Execute binary to inherit CAP_SETUID or equivalent
  6. Impact
    Escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions

Requires an unprivileged local shell on an affected RHEL 6-10 or OpenShift 4 host (PR:L, AV:L) and write access to a parent directory of a path that a privileged process will pass to cap_set_file()/setcap; the attacker must also win a TOCTOU race between the library's path resolution and the underlying setxattr() call, which is why AC:H. Exploitation is limited by the need for a concurrent privileged setcap operation to target a path under attacker-controlled directory ownership - on hosts where setcap is only invoked by package installation in root-owned trees the practical attack surface is minimal, while build servers, CI runners, and multi-tenant systems are materially more exposed. No user interaction (UI:N) and no remote vector - purely local.
Impact

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.0 High and accurately reflects the threat model: local access and low privileges are required, attack complexity is High because winning a race window is non-deterministic, but impact is total on confidentiality, integrity, and availability once the race is won. CISA SSVC corroborates this with Technical Impact: total but Exploitation: none and Automatable: no, and EPSS is only 0.01% (1st percentile), so this is a high-impact but currently low-likelihood issue rather than a mass-exploitation priority. There is no CISA KEV listing and no public exploit identified at time of analysis, which is consistent with a race-condition flaw that requires a specific privileged setcap operation to be racing against an attacker-controlled directory - a non-default precondition that limits opportunistic abuse. Prioritize patching on multi-tenant hosts, shared build systems, and container hosts where untrusted local users coexist with privileged capability-setting workflows; on single-tenant servers the practical risk is materially lower.
Exploit ScenarioDerived

An unprivileged user on a shared RHEL host monitors a directory they can write to which is also used by a packaging or build script that runs setcap as root on a freshly built binary. As the script invokes cap_set_file() the attacker wins the TOCTOU window by renaming or symlinking the validated path so the security.capability xattr is written onto an attacker-staged binary granting CAP_SETUID, which they then execute to obtain root; no public exploit is identified at time of analysis and the High attack complexity reflects the race window.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 11, 2026

Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.

Earlier versions of this analysis (2)
v2 Jun 11, 2026 - 10:28 cvss changed CVSS 7.0

Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 by exploiting a TOCTOU race between capability validation and the actual file write. An unprivileged local user with write access to a parent directory can swap the target path between the check and use to inject or strip Linux file capabilities on attacker-chosen executables, enabling privilege escalation. No public exploit identified at time of analysis and EPSS is 0.01%, but SSVC rates technical impact as total.

v1 Apr 09, 2026 - 15:30 CVSS 6.7

Local privilege escalation in libcap allows unprivileged users to exploit a race condition in cap_set_file() by redirecting capability updates to attacker-controlled files via symlink manipulation in parent directories. An authenticated local attacker with write access to a parent directory and user interaction can inject or strip capabilities from arbitrary executables, achieving privilege escalation. No public exploit code or confirmed active exploitation has been identified at this time.

RemediationAI

Patch available per vendor advisory: update libcap to the fixed package versions distributed in RHSA-2026:7473 (and the follow-on errata RHSA-2026:12423, RHSA-2026:12441, RHSA-2026:13285) for Red Hat Enterprise Linux 6/7/8/9/10 and OpenShift Container Platform 4, and to the equivalents in SUSE-SU-2026:1432 / SUSE-SU-2026:1433 for SUSE; on RHEL run 'dnf update libcap' and reboot or restart services that link against it. Until patched, the most effective compensating control is to ensure no unprivileged user has write access to any parent directory of a path that root or another capability-bearing process passes to setcap/cap_set_file() - audit build pipelines, container image builders, and shared scratch directories for directories writable by untrusted users that contain executables ever subjected to setcap, and relocate setcap operations into root-owned, mode 0755 directories. Where feasible, avoid running setcap on files in user-writable trees and prefer baking capabilities into immutable images; note that disabling file capabilities entirely is rarely practical because many distro packages rely on them (ping, etc.).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libcap is the userspace library implementing the POSIX.1e capability model on Linux, providing the setcap/getcap utilities and the cap_set_file() API that wraps the underlying setxattr() syscall on the security.capability extended attribute. The flaw is a classic CWE-367 Time-of-Check Time-of-Use race: cap_set_file() resolves and validates a path before performing the capability write, so between those two steps an attacker who controls the containing directory can swap the target (for example via rename or symlink manipulation) so the privileged xattr is applied to a file the attacker chose rather than the one validated. Because Linux file capabilities are honored on execve() and can grant powers such as CAP_SETUID, CAP_DAC_OVERRIDE, or CAP_SYS_ADMIN, redirecting that write to an attacker-controlled SUID-like target produces full local privilege escalation. The affected products per CPE are Red Hat Enterprise Linux 6, 7, 8, 9, and 10 and Red Hat OpenShift Container Platform 4, all of which ship libcap as a core dependency.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local unprivileged user (AV:L, PR:L) must win a TOCTOU race (AC:H) with no user interaction; successful capability injection yields full root, so C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Red Hat 6.7 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jun 11, 2026 - 10:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 11, 2026 - 10:28 vuln.today
v2 - CVSS changed
Severity Changed
Jun 11, 2026 - 10:22 NVD
MEDIUM HIGH
CVSS changed
Jun 11, 2026 - 10:22 NVD
6.7 (MEDIUM) 7.0 (HIGH)
CVE Published
Apr 09, 2026 - 14:49 nvd
MEDIUM 6.7

DescriptionNVD

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Executive ViewAI

Why It Matters

A vulnerability in libcap (a core Linux system library) used by Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 allows any unprivileged user-including containers and internal staff-to gain full administrative control of affected systems. For organizations running these platforms, this represents a complete system compromise risk for every affected host. A vendor patch is available and must be deployed immediately to prevent privilege escalation attacks.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Affected Products (CPE)NVD

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container private-registry/harbor-core:1.1.2-2.22 Container private-registry/harbor-exporter:1.1.2-2.22 Container private-registry/harbor-jobservice:1.1.2-2.22 Container private-registry/harbor-portal:1.1.2-2.23 Container private-registry/harbor-registry:1.1.2-2.22 Container private-registry/harbor-registryctl:1.1.2-2.22 Container private-registry/harbor-trivy-adapter:1.1.2-2.25 Container suse/manager/4.3/proxy-httpd:4.3.17.9.76.10 Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.11 Container suse/manager/4.3/proxy-squid:4.3.17.9.75.8 Container suse/manager/4.3/proxy-ssh:4.3.17.9.66.8 Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.9 Container suse/sle-micro/base-5.5:2.0.4-5.8.263 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.507 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.225 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.163 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.130 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.147 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.96 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/356016 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1432/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1433/ REF http://www.openwall.com/lists/oss-security/2026/04/07/14 REF http://www.openwall.com/lists/oss-security/2026/04/07/4 REF http://www.openwall.com/lists/oss-security/2026/04/08/9 REF http://www.openwall.com/lists/oss-security/2026/04/09/5 REF http://www.openwall.com/lists/oss-security/2026/04/09/6 REF https://access.redhat.com/errata/RHSA-2026:12423 REF https://access.redhat.com/errata/RHSA-2026:12441 REF https://access.redhat.com/errata/RHSA-2026:13285 REF https://access.redhat.com/errata/RHSA-2026:14162 REF https://access.redhat.com/errata/RHSA-2026:14937 REF https://access.redhat.com/errata/RHSA-2026:19130 REF https://access.redhat.com/errata/RHSA-2026:19346 REF https://access.redhat.com/errata/RHSA-2026:19456 REF https://access.redhat.com/errata/RHSA-2026:19458 REF https://access.redhat.com/errata/RHSA-2026:20595 REF https://access.redhat.com/errata/RHSA-2026:21254 REF https://access.redhat.com/errata/RHSA-2026:21275 REF https://access.redhat.com/errata/RHSA-2026:22634 REF https://access.redhat.com/errata/RHSA-2026:22957 REF https://access.redhat.com/errata/RHSA-2026:23233 REF https://access.redhat.com/errata/RHSA-2026:23245 REF https://access.redhat.com/errata/RHSA-2026:24346 REF https://access.redhat.com/errata/RHSA-2026:25044 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:25181 REF https://access.redhat.com/errata/RHSA-2026:26542 REF https://access.redhat.com/errata/RHSA-2026:27998 REF https://access.redhat.com/errata/RHSA-2026:28887 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30078 REF https://access.redhat.com/errata/RHSA-2026:30087 REF https://access.redhat.com/errata/RHSA-2026:30088 REF https://access.redhat.com/errata/RHSA-2026:30089 REF https://access.redhat.com/errata/RHSA-2026:34098 REF https://access.redhat.com/errata/RHSA-2026:39981 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:7473 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-4878 REF https://bugzilla.redhat.com/show_bug.cgi?id=2447554 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451615 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4878.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy