---
id: CVE-2026-26104
title: >-
  Udisks: missing authorization check allows unprivileged users to back up luks
  headers via udisks d-bus api
summary: >-
  A flaw was found in the udisks storage management daemon that allows
  unprivileged users to back up LUKS encryption headers without authorization.
  The issue occurs because a privileged D-Bus method responsible for exporting
  encryption met…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Red Hat
product: udisks2
affected:
  - udisks2 (all versions)
  - udisks2 (all versions)
  - udisks
  - udisks2
  - udisks2
  - udisks2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-02-25T20:49:09.190143Z'
published: '2026-02-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:14.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-26104'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:3476'
    label: 'RHSA-2026:3476'
  - url: 'https://access.redhat.com/errata/RHSA-2026:5831'
    label: 'RHSA-2026:5831'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-26104'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2433717'
    label: RHBZ#2433717
  - url: >-
      https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw
tags:
  - cve.org
epss: 0.00082
epssPercentile: 0.0019
ingestedAt: '2026-11-05T22:38:31.560Z'
---

## Overview

A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.

## Affected

- `udisks2 (all versions)`
- `udisks2 (all versions)`
- `udisks`
- `udisks2`
- `udisks2`
- `udisks2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability.