---
id: CVE-2026-111253
title: >-
  Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows
  foreign d-bus callers to replace another client's resolved transaction
summary: >-
  A flaw was found in dnf5daemon-server. Session methods on dynamically exported
  D-Bus session objects do not verify that the caller is the unique sender that
  created the session. A local attacker can modify another user's live
  package-man…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: Red Hat
product: dnf5
affected:
  - dnf5 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T16:46:12.036788Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:46:26.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111253'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-111253'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2553683'
    label: RHBZ#2553683
  - url: >-
      https://github.com/rpm-software-management/dnf5/commit/46a4a8ad8d34af91ec2add6bb29e487571ea6c85
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.402Z'
---

## Overview

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.

## Affected

- `dnf5 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Until a fixed build is available, avoid leaving interactive dnf5daemon sessions open on multi-user systems where untrusted local accounts can access the system bus, and close sessions promptly after use.