2452086 – (CVE-2026-4948) CVE-2026-4948 firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization

Bug 2452086 (CVE-2026-4948) - CVE-2026-4948 firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization

Summary: CVE-2026-4948 firewalld: firewalld: Local unprivileged user can modify firewa...

Keywords:
Status:	NEW
Alias:	CVE-2026-4948
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-03-27 05:19 UTC by OSIDB Bzimport
Modified:	2026-10-06 16:35 UTC (History)
CC List:	17 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:67585	None	None	None	2026-09-15 17:24:55 UTC
Red Hat Product Errata	RHSA-2026:67843	None	None	None	2026-09-16 06:49:32 UTC
Red Hat Product Errata	RHSA-2026:76844	None	None	None	2026-10-06 16:35:07 UTC

Description OSIDB Bzimport 2026-03-27 05:19:18 UTC

firewalld <=2.4.0 appears to mis-authorize two runtime D-Bus setters, setZoneSettings2 and setPolicySettings, by guarding them with PK_ACTION_CONFIG_INFO.  When the shipped desktop policy is active, that appears to let a local unprivileged user modify runtime firewall state without authentication. The attacker needs to have local, unprivileged access to a system with firewalld using the  desktop profile of firewalld.

Comment 2 Jon Orris 2026-09-15 17:24:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67585 https://access.redhat.com/errata/RHSA-2026:67585

Comment 3 Jon Orris 2026-09-16 06:49:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:67843 https://access.redhat.com/errata/RHSA-2026:67843

Comment 4 Jon Orris 2026-10-06 16:35:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:76844 https://access.redhat.com/errata/RHSA-2026:76844

Note You need to log in before you can comment on or make changes to this bug.