Skip to main content

GLib CVE-2026-58015

| EUVDEUVD-2026-40318 HIGH
Path Traversal (CWE-22)
2026-06-30 secalert@redhat.com GHSA-hmpf-72wc-2r6x
Information Disclosure Path Traversal Red Hat Enterprise Linux Glib Gnome
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure GLib client to malicious D-Bus server
  2. Delivery
    Offer DBUS_COOKIE_SHA1 SASL mechanism
  3. Exploit
    Send cookie_context with '../' traversal
  4. Execution
    Client reads attacker-chosen file
  5. Persist
    Use hash responses as content oracle
  6. Impact
    Exfiltrate sensitive file data

Vulnerability Assessment

Weakness
CWE
CWE-22
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that a GLib-based D-Bus client (GDBus, versions before 2.88.1) be induced to connect to an attacker-controlled or compromised D-Bus server and negotiate the DBUS_COOKIE_SHA1 SASL mechanism - this mechanism is used on non-EXTERNAL transports such as TCP, not on standard local Unix-socket buses that use EXTERNAL auth. The malicious server must supply a crafted cookie_context value containing path-traversal sequences, and the target file must be readable by the client process for its contents to be inferred via the hash-verification oracle. Limiting factors: the victim must actively connect to the hostile server (deployments that only use local Unix-socket D-Bus with EXTERNAL authentication are not exposed), disclosure is confined to files accessible to the client's privileges, and there is no integrity or availability impact.
Impact

The signals are broadly consistent and point to a real but non-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, score 7.5) captures high confidentiality impact with no integrity or availability loss, but the AV:N rating deserves scrutiny: DBUS_COOKIE_SHA1 is primarily used for non-local (e.g., TCP) D-Bus transports, and exploitation fundamentally requires the victim client to connect to an attacker-controlled D-Bus server - an implicit precondition not reflected in the vector's PR:N/UI:N. EPSS is low (0.30%, 22th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and the flaw is absent from CISA KEV, so this is not evidence of active or widespread exploitation. Net: a legitimately high-CVSS information-disclosure bug in a ubiquitous library, but real-world risk is gated by the requirement to lure a client to a malicious server, making it more of a routine-patch priority than an emergency.
Exploit ScenarioDerived

An attacker stands up a malicious D-Bus server (or compromises one) and induces a victim application built on GLib to connect and negotiate DBUS_COOKIE_SHA1 authentication. The server returns a cookie_context laced with '../' traversal sequences pointing at a sensitive file (for example a private key or credential file readable by the client process), then uses the client's authentication hash responses as an oracle to confirm guessed file contents byte-by-byte. No public proof-of-concept has been identified, and given AC:L the mechanics are straightforward once a client can be steered to the attacker's server.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 01, 2026

Arbitrary file disclosure in GLib's GDBus client affects the DBUS_COOKIE_SHA1 SASL authentication mechanism, where the client fails to validate the server-supplied cookie_context parameter. A malicious or compromised D-Bus server can send a cookie_context containing path traversal sequences, forcing the client to read attacker-chosen files and leak their contents by confirming guessed values against the returned authentication hash. No public exploit has been identified and it is not in CISA KEV; EPSS is low at 0.30% (22th percentile), consistent with the SSVC assessment of no known exploitation.

Earlier versions of this analysis (2)
v2 Jul 01, 2026 - 18:14 cvss changed CVSS 7.5

Arbitrary file disclosure in GLib's GDBus client (fixed in 2.88.1) arises because the client-side DBUS_COOKIE_SHA1 SASL authentication handler trusts the server-supplied cookie_context value without sanitization, letting a malicious or compromised D-Bus server that a client connects to embed path-traversal sequences and coerce the client into reading arbitrary files it has access to. The attacker recovers file contents through a hash-verification oracle rather than direct read-back, so exfiltration is confirm-by-guess rather than bulk. There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC rates exploitation as none with only partial technical impact.

v1 Jun 30, 2026 - 13:36 CVSS 5.9

Path traversal in GLib's D-Bus DBUS_COOKIE_SHA1 SASL authentication allows a malicious D-Bus server to exfiltrate arbitrary files readable by the connecting client process. By supplying an unsanitized cookie_context value containing directory traversal sequences, the server causes the GLib client to read a file outside the intended ~/.dbus-keyrings/ directory and incorporate its contents into a SASL hash response, which the attacker can then use as an oracle to verify guessed file contents. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; however, the CVSS confidentiality impact is rated High given the file-read primitive.

RemediationAI

Vendor-released patch: upgrade GLib to 2.88.1 or later, which adds validation of the cookie_context parameter; on Red Hat Enterprise Linux 6-10, apply the distribution's updated glib2 package once published and track status via https://access.redhat.com/security/cve/CVE-2026-58015 and the upstream fix at https://gitlab.gnome.org/GNOME/glib/-/issues/3931. Until patched, the most effective compensating control is to avoid initiating GDBus client connections to untrusted or remote D-Bus servers and to prefer local Unix-domain-socket transports (which use EXTERNAL auth rather than DBUS_COOKIE_SHA1), disabling or blocking TCP D-Bus listeners (default port range) at the host/network level; the trade-off is that legitimate remote or cross-machine D-Bus integrations relying on cookie authentication will break. Restricting which processes may reach external bus endpoints and monitoring for unexpected outbound D-Bus connections further limits exposure.

Affected VersionsENISA

glib 0 <2.88.1

Affected Packages

euvd glib fix: 2.88.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GLib (GObject/GLib, the GNOME core utility library) implements D-Bus via its GDBus stack, including the SASL authentication handshake used when a client connects to a bus or peer. The DBUS_COOKIE_SHA1 mechanism authenticates by having both sides read a shared secret from a cookie file located under a directory identified by the cookie_context token, then exchanging SHA1 hashes computed over that secret plus challenge data. The root cause is a path-traversal / improper-input-validation class weakness (aligned with CWE-22, though the input lists CWE as N/A): the client trusts the cookie_context value from the server and uses it to build a filesystem path without sanitizing '../' sequences, so the server can point the client at arbitrary files. Affected CPEs are cpe:2.3:a:gnome:glib and Red Hat Enterprise Linux 6 through 10 (cpe:2.3:o:redhat:enterprise_linux), reflecting GLib's role as a base OS component.

Know when Glib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY MEDIUM
NVD 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 6.5 MEDIUM

Network-reachable via TCP D-Bus and low complexity, but the victim client must be induced to connect to the malicious server (UI:R); only confidentiality is impacted (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.9 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 01, 2026 - 18:14 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 01, 2026 - 18:14 vuln.today
v2 - CVSS changed
Severity Changed
Jul 01, 2026 - 18:07 NVD
MEDIUM HIGH
CVSS changed
Jul 01, 2026 - 18:07 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch available
Jun 30, 2026 - 16:01 EUVD

DescriptionNVD

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Executive ViewAI

Why It Matters

GLib's GDBus client contains an arbitrary file disclosure vulnerability (CVE-2026-58015) in its SASL authentication mechanism, allowing a malicious or compromised D-Bus server to read sensitive files from affected systems. Organizations using GLib/GDBus face potential data exposure including credentials and configuration files. No public exploit has been identified at time of analysis, and a patch is available from the vendor.

Business Impact: High
Compensating Controls

Patch available per vendor advisory. Interim mitigations for unpatched systems: Implement network-level access controls to restrict D-Bus communication to trusted systems only; disable D-Bus services where not required; monitor system logs for authentication errors and D-Bus activity anomalies.

Threat Intelligence Overview

EPSS Score
0.3%
Top 78% exploitable
Prevalence
Ubiquitous
GLib is a core dependency across virtually all Linux desktop and server systems
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Glib

View all
CVE-2024-52533 CRITICAL POC
9.8 Nov 11

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CON
CVE-2018-16428 CRITICAL POC
9.8 Sep 04

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference. Rated critical sev
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2021-27219 HIGH POC
7.5 Feb 15

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. Rated high severity (CVSS 7.5), this vulne
CVE-2020-35457 HIGH POC
7.8 Dec 14

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entri
CVE-2018-16429 HIGH POC
7.5 Sep 04

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf
CVE-2020-6750 MEDIUM POC
5.9 Jan 09

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting v
CVE-2025-14087 CRITICAL
9.8 Dec 10

Heap corruption in GLib (GNOME's core C utility library) lets remote attackers trigger a buffer-underflow in the GVarian
CVE-2021-28153 MEDIUM POC
5.3 Mar 11

An issue was discovered in GNOME GLib before 2.66.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
CVE-2019-12450 CRITICAL
9.8 May 29

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while

CVE-2024-34397 MEDIUM POC
5.2 May 07

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. Rated medium severity (CVSS 5.
CVE-2026-58016 CRITICAL
9.1 Jun 30

Denial of service in GNOME GLib (versions before 2.88.1) arises when g_dbus_node_info_new_for_xml() parses malformed D-B

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58015 ADVISORY https://ubuntu.com/security/notices/USN-8794-1 ADVISORY https://vuldb.com/vuln/374852 REF https://access.redhat.com/errata/RHSA-2026:49512 REF https://access.redhat.com/errata/RHSA-2026:55440 REF https://access.redhat.com/errata/RHSA-2026:57015 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:61766 REF https://access.redhat.com/errata/RHSA-2026:61783 REF https://access.redhat.com/errata/RHSA-2026:63135 REF https://access.redhat.com/errata/RHSA-2026:63138 REF https://access.redhat.com/errata/RHSA-2026:63140 REF https://access.redhat.com/errata/RHSA-2026:65762 REF https://access.redhat.com/errata/RHSA-2026:65763 REF https://access.redhat.com/errata/RHSA-2026:65767 REF https://access.redhat.com/errata/RHSA-2026:65768 REF https://access.redhat.com/errata/RHSA-2026:65769 REF https://access.redhat.com/errata/RHSA-2026:65770 REF https://access.redhat.com/errata/RHSA-2026:65771 REF https://access.redhat.com/errata/RHSA-2026:65773 REF https://access.redhat.com/errata/RHSA-2026:66018 REF https://access.redhat.com/errata/RHSA-2026:66357 REF https://access.redhat.com/errata/RHSA-2026:70646 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73859 REF https://access.redhat.com/errata/RHSA-2026:73866 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73929 REF https://access.redhat.com/errata/RHSA-2026:73930 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:74677 REF https://access.redhat.com/errata/RHSA-2026:74678 REF https://access.redhat.com/errata/RHSA-2026:74679 REF https://access.redhat.com/errata/RHSA-2026:74681 REF https://access.redhat.com/errata/RHSA-2026:74683 REF https://access.redhat.com/errata/RHSA-2026:74685 REF https://access.redhat.com/errata/RHSA-2026:74687 REF https://access.redhat.com/errata/RHSA-2026:74688 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75655 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:77320 REF https://access.redhat.com/errata/RHSA-2026:80769 REF https://access.redhat.com/errata/RHSA-2026:80771 REF https://access.redhat.com/errata/RHSA-2026:82059 REF https://access.redhat.com/errata/RHSA-2026:82061 REF https://access.redhat.com/errata/RHSA-2026:82066 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82368 REF https://access.redhat.com/errata/RHSA-2026:82371 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82415 REF https://access.redhat.com/errata/RHSA-2026:82811 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/errata/RHSA-2026:92449 REF https://access.redhat.com/errata/RHSA-2026:92452 REF https://access.redhat.com/security/cve/CVE-2026-58015 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492256 REF https://gitlab.gnome.org/GNOME/glib/-/issues/3931

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy