CVE-2026-73584Medium· 6.3▾ SunlitA flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the at…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.
sblim-sfcb (all versions)sblim-sfcbsblim-sfcb (all versions)sblim-sfcb (all versions)sblim-sfcb (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, if instance migration is not required, run the sfcbrepos command with the -i option to disable the vulnerable migration path. For example: sudo sfcbrepos -f -i. Alternatively, avoid running sfcbrepos with elevated privileges on systems where untrusted local users can concurrently write to the /tmp directory. A service restart or reload may be required for changes to take effect if sfcbrepos is managed by a service.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73583Medium· 6.6Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr
CVE-2026-73585Medium· 6.3Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack
CVE-2026-120749Medium· 6.2Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
CVE-2026-123037Medium· 6.7Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
CVE-2026-121837Medium· 4.3Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
CVE-2026-109081Medium· 6.8Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint