CVE-2023-3899High· 7.8▾ TwilightA vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the sta…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-manager (all versions)subscription-managerRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
A workaround is to mask rhsm.service using:
systemctl mask rhsm.service
When the rhsm.service is masked, then no D-Bus call cannot trigger the service and all D-Bus calls will be terminated with error: "Call failed: Could not activate remote peer." But then all applications using D-Bus API will not work until you unmask the service using: "systemctl unmask rhsm.service"
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-6840Medium· 6.6Automation-controller: gain access to the k8s api server via job execution with container group
CVE-2023-5675Medium· 6.5Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.
CVE-2024-8676High· 7.4A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it
CVE-2026-120984Critical· 9.1Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
CVE-2026-83495NoneTrainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration
CVE-2026-50240High· 8.8Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount