clevis PKCS#11 pin EUVD-2026-100955

Exploitation requires that the system actually uses the clevis PKCS#11 pin for LUKS decryption - i.e. the clevis-luks-pkcs11-askpin script is invoked with a PKCS#11 token binding; this is a non-default, specialized configuration. A local unprivileged account is required to read the PIN file, which is world-readable due to the missing restrictive permissions combined with the default process umask. Limiting factors: (1) attack is local only, not remote; (2) in the normal path the attacker must read the file during the brief window it exists (reflected in AC:H), though (3) the secondary flaw - failure to clean up the PIN file on early script exit - removes the timing constraint and leaves the PIN readable indefinitely. No user interaction is needed.

This is a genuine but low-to-moderate priority information-disclosure issue, not a high-urgency remote threat. The CVSS 3.1 base score of 4.7 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N: exploitation is strictly local (AV:L), requires an existing low-privileged local account (PR:L), and carries high attack complexity (AC:H) because an attacker must win a timing window while the plaintext PIN file exists - or rely on the secondary cleanup-failure path that leaves it behind indefinitely. Impact is confined to confidentiality (C:H) - disclosure of the PKCS#11 token PIN - with no integrity or availability impact. No EPSS score, KEV listing, SSVC decision, or POC was supplied in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality rating of C:H is defensible given the PIN protects a LUKS volume, but the practical risk is bounded by the requirement for local access and by the non-default nature of the clevis PKCS#11 pin feature. No key signals conflict: the vector's local/authenticated framing matches the description's reliance on filesystem permissions and process umask. The main gap is the absence of exploitation-probability data (no EPSS/KEV/POC), so prioritization rests on CVSS and the described conditions alone.

On a RHEL system configured to unlock a LUKS volume via the clevis PKCS#11 pin, a local unprivileged user monitors the directory where clevis-luks-pkcs11-askpin writes the token PIN. Because the file is created world-readable under the default umask, the attacker reads the plaintext PIN during the unlock window - or at any time afterward if the decryption script exited early and failed to remove the file. No public exploit is identified at time of analysis; exploitation requires a local account and the high-complexity timing/configuration conditions reflected in AC:H.