Skip to main content

open-iscsi EUVDEUVD-2026-50311

| CVE-2026-44943 MEDIUM
Path Traversal (CWE-22)
2026-07-29 meissner@suse.de GHSA-36cw-9hwh-mr3c
Path Traversal Red Hat Suse
6.9
CVSS 4.0 · Vendor: suse
Share

Severity by source

Vendor (suse) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

MITM requirement raises AC:H; no privileges needed on initiator; integrity-only impact via file creation.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.6 HIGH
qualitative

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jul 29, 2026 - 13:34 vuln.today
Analysis Generated
Jul 29, 2026 - 13:34 vuln.today

DescriptionCVE.org

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

AnalysisAI

Path traversal in open-iscsi allows remote MITM attackers to create root-owned files at arbitrary filesystem locations and inject lines into records by embedding RFC 3722-prohibited characters in IQN target names returned during iSNS or firmware discovery. All open-iscsi versions through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e are affected across the iSNS discovery, firmware discovery, and command-line target-name paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 score of 6.9 with network vector and no privileges required warrants attention in enterprise storage environments where iSCSI discovery is exposed.

Technical ContextAI

open-iscsi is the standard Linux iSCSI initiator implementing RFC 3720, enabling servers to mount remote block storage over TCP/IP. The iSNS (Internet Storage Name Service) discovery subsystem in usr/discovery.c, usr/iscsiadm.c, and usr/iscsistart.c accepted IQN (iSCSI Qualified Names) returned by storage name servers without validating their character content against RFC 3722 section 6.2 restrictions. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) manifests because IQN names serve as identifiers that map to filesystem paths in the open-iscsi database; names containing path-separator characters or other special characters allow writes outside the intended database directory. The fix introduces iqn_name_valid() in usr/initiator_common.c, which rejects names containing control characters (≤0x2C), forward slashes (0x2F), semicolons through at-sign (0x3B-0x40), brackets through backtick (0x5B-0x60), and characters above 0x7A. A separate fix in iscsiuio/src/unix/iscsid_ipc.c corrects a wrong socket descriptor (iscsid_opts.fd → s2) in the peer-user authentication check and changes a break to continue, addressing a related authentication bypass in the IPC path.

RemediationAI

The upstream fix is available as commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e in the open-iscsi GitHub repository at https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e; no tagged release version incorporating this fix has been confirmed from the available data. Administrators should update to the first open-iscsi package release from their Linux distribution vendor (e.g., SUSE, Red Hat, Debian, Ubuntu) that includes this commit, and monitor https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943 for SUSE-specific patch availability. As a compensating control pending patching, restrict iSCSI initiator hosts to known-good iSNS servers via network ACLs and firewall rules, eliminating the MITM opportunity by ensuring iSNS discovery traffic cannot be intercepted or redirected. Where iSNS discovery is not operationally required, disable it and use static target configuration via iscsiadm with manually specified, validated target addresses and IQNs - this removes the vulnerable discovery code path entirely. Network segmentation of iSCSI traffic onto isolated storage VLANs with no untrusted hosts reduces MITM exposure significantly.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

EUVD-2026-50311 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy