Bug 2567426 (CVE-2026-123177)

Summary: CVE-2026-123177 dnf5: dnf5daemon-server: dnf5daemon-server: unauthenticated privileged cmdline package fetch/open via add_cmdline_packages
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-13   

Description OSIDB Bzimport 2026-11-05 21:05:49 UTC 
A flaw was found in dnf5daemon-server. Multiple unauthenticated D-Bus methods (Rpm.list, Rpm.list_fd, and Rpm.install/upgrade/downgrade/reinstall followed by Goal.resolve) pass caller-controlled patterns into libdnf5 add_cmdline_packages(). URL patterns (file://, http(s)://, ftp://) are downloaded as root into the world-readable /var/cache/dnf5daemon-server directory before RPM validation and without a download size quota. Non-URL patterns ending in .rpm are opened directly as root from attacker-controlled paths (for example symlinks or FIFOs under an attacker-owned directory). A local unprivileged user can disclose arbitrary content the root daemon can open, obtain capability-gated /proc data such as real /proc/kallsyms addresses, fetch remote URLs as root into a world-readable cache, and exhaust disk space via unbounded downloads.