Skip to main content

QEMU Guest Agent EUVDEUVD-2026-45941

| CVE-2026-12080 HIGH
UNIX Symbolic Link (Symlink) Following (CWE-61)
2026-07-20 redhat GHSA-9xqq-92hv-jj34
7.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Local low-priv guest user (AV:L/PR:L); the file variant is a TOCTOU race (AC:H); guest-to-root crossing a trust boundary via the root agent warrants S:C, with full C/I/A on root compromise.

3.1 AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
HIGH
qualitative
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 20, 2026 - 13:22 vuln.today
CVE Published
Jul 20, 2026 - 12:40 nvd
HIGH 7.3

DescriptionCVE.org

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

AnalysisAI

Local privilege escalation to root in the QEMU Guest Agent (qga) affects Red Hat Enterprise Linux 6 through 10, RHEL for NVIDIA 26, and OpenShift Container Platform 4, where a local unprivileged guest user abuses the guest-ssh-add-authorized-keys command handler through symlink manipulation to seize ownership of arbitrary root-owned files. Two attack variants exist - a deterministic directory-symlink bypass and a TOCTOU file-symlink race - both requiring an external management layer such as libvirt to invoke the code path. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain unprivileged shell in guest VM
Delivery
Plant malicious symlink on target path
Exploit
Management layer invokes guest-ssh-add-authorized-keys
Execution
Root agent follows symlink / wins TOCTOU race
Persist
Gain ownership of root-owned file
Impact
Escalate to root in guest

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) a local unprivileged shell inside the guest VM (PR:L); (2) the QEMU Guest Agent running as root in that guest with the guest-ssh-add-authorized-keys RPC enabled/allowlisted; and (3) an external management layer such as libvirt or the orchestrator actually invoking that command handler (UI:R) - the vulnerable code path is not self-triggered by the local attacker and is unreachable if the host never issues the SSH-key command. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.3, High) describes a local attack (AV:L) by an already-authenticated low-privileged guest user (PR:L) that yields full confidentiality, integrity, and availability impact by way of root file ownership. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unprivileged user with a shell inside a RHEL or OpenShift-hosted VM pre-plants a symbolic link in the path that guest-ssh-add-authorized-keys will operate on, then waits for (or induces) the libvirt-based management layer to trigger the SSH-key-injection command. The root-privileged agent follows the attacker's directory symlink - or, in the file variant, the attacker wins a TOCTOU race by swapping the target for a symlink mid-operation - causing root to take actions against an attacker-chosen file and handing the attacker ownership of a root-owned resource for full root escalation. …
Remediation Apply the qemu-guest-agent update for your Red Hat release once published; exact fixed versions are not enumerated in the available data, so track and cite the per-release errata from the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12080 and Bugzilla 2499603 (https://bugzilla.redhat.com/show_bug.cgi?id=2499603) rather than an assumed version number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running affected QEMU Guest Agent versions across RHEL 6, 7, 8, 9, 10 and OpenShift Container Platform 4, and assess whether guest-ssh-add-authorized-keys functionality is operationally necessary; disable or restrict this handler if not business-critical, and audit all guest user accounts for unnecessary privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-45941 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy