Suricata CVE-2026-59674

Exploitation requires the attacker to already possess the 'suricata' user context on an openSUSE Tumbleweed host running the suricata package before 8.0.5-2.1 (PR:L, AV:L) - this is a local, authenticated-as-service-account escalation, not remotely reachable. The concrete prerequisite is the ability to create a symbolic link in a directory the suricata user can write to that is subsequently operated on by a root-privileged package action (log rotation, unit start/stop, or maintenance script); the attacker must also be able to trigger or wait for that root operation to run. Limiting factors: no exploitation is possible without first obtaining the suricata account, the flaw is specific to SUSE's Tumbleweed packaging (upstream and other distros are not affected), and hosts not running Suricata are not exposed.

This is a credible local privilege-escalation issue but not an internet-facing emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms local access, low complexity, no user interaction, and already-held low privileges (the suricata account) leading to full confidentiality/integrity/availability impact on the host - consistent with root takeover. The 7.1 score reflects that impact tempered by the local vector and the E:P (Proof-of-Concept) threat metric. There is no CISA KEV listing, so treat this as not confirmed actively exploited; the E:P maturity indicates proof-of-concept-level exploit knowledge rather than widespread weaponization, and no separate EPSS score was provided in the input. Real-world priority is moderate: it requires a foothold as the suricata user first, so it functions as a post-compromise escalation primitive most relevant on hosts where Suricata is exposed to untrusted network processing and could be crashed or subverted.

An attacker who has compromised or already controls the low-privileged suricata service account (for example after subverting the exposed detection process) places a symbolic link at a predictable path that a root-run package operation writes to or chowns. When that root operation fires - during log rotation, service restart, or a scheduled task - it follows the link and modifies an attacker-chosen target such as /etc/passwd or a root-owned script, granting root. The CVSS 4.0 Proof-of-Concept exploit maturity (E:P) indicates working exploitation technique is known.