Skip to main content

yast2-users CVE-2026-59680

| EUVDEUVD-2026-68996 HIGH
OS Command Injection (CWE-78)
2026-09-01 suse GHSA-qvch-9vjh-pr6p
Command Injection Suse Yast2 Users
8.6
CVSS 4.0 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.0 HIGH

Attacker must control or compromise external LDAP (AC:H, PR:L); admin must browse specific tab (UI:R); root execution on admin host constitutes scope change.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.0 HIGH
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
Sep 01, 2026 - 10:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 01, 2026 - 10:22 vuln.today
cvss_changed
CVSS changed
Sep 01, 2026 - 10:22 NVD
8.0 (HIGH) 8.6 (HIGH)
Analysis Generated
Sep 01, 2026 - 09:51 vuln.today
CVE Published
Sep 01, 2026 - 09:20 cve.org
HIGH 8.0

DescriptionCVE.org

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping.

Impact: an administrator who manages users against an external/federated LDAP directory via yast2 users triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry.

This issue affects yast2-users through 5.0.8.

AnalysisAI

OS command injection in yast2-users (through version 5.0.8) allows root-level arbitrary command execution on SUSE Linux systems when an administrator views a malicious LDAP user's Password Settings tab. The get_password_term() function reads shadowLastChange and shadowExpire LDAP attributes without numeric validation and passes them to format_days_after_epoch(), which interpolates the values directly into a shell command executed via Ruby backticks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) the target system runs yast2-users version 5.0.8 or earlier on a SUSE Linux distribution; (2) yast2-users is configured to manage users from an external or federated LDAP directory - systems using only local user management are not affected; (3) the attacker has write access sufficient to set arbitrary string values in the `shadowLastChange` or `shadowExpire` LDAP attributes of at least one LDAP user entry; (4) a privileged administrator opens the yast2-users interface and navigates to that specific user's Password Settings tab. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 (High) with AV:N/AC:L/PR:L/UI:P reflects a meaningful threat when external LDAP integration is active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade yast2-users to a version beyond 5.0.8 once a patched release is confirmed; no exact fixed version number is available at time of analysis - monitor https://bugzilla.suse.com/show_bug.cgi?id=1272839 for patch availability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all SUSE systems running yast2-users version 5.0.8 or earlier and document those with LDAP integration; immediately restrict user management tool access to essential administrators only and review LDAP directory access logs. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Installer Updates 15 SP4 Affected

Share

CVE-2026-59680 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy