CVE-2026-58015 Details
Description
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
A path traversal vulnerability has been identified in GLib's D-Bus client implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism. The issue arises because the client does not properly validate the cookie_context parameter received from the server. This oversight allows a malicious D-Bus server to inject path traversal sequences, leading the client to read arbitrary files and exfiltrate sensitive information by hashing the file contents and sending the hash back to the server. The vulnerability affects all GLib versions that implement DBUS_COOKIE_SHA1 client-side authentication, including the latest release 2.87.2.
Users can mitigate this vulnerability by ensuring that applications only connect to trusted D-Bus servers and by disabling the DBUS_COOKIE_SHA1 authentication mechanism, if possible. For Red Hat Enterprise Linux users, a patch is available in the GLib 2.88.1 update.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gnome glib | < 2.88.1 |
CPE
Remediation
| |
| redhat enterprise linux | 6.0 7.0 8.0 9.0 10.0 |
CPE
Remediation
| |
Change History
19 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | [email protected] |
| Sep 10, 2026 | CVE Modified | [email protected] |
| Sep 9, 2026 | CVE Modified | [email protected] |
| Sep 9, 2026 | CVE Modified | [email protected] |
| Sep 9, 2026 | CVE Modified | [email protected] |
| Sep 8, 2026 | CVE Modified | [email protected] |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 25, 2026 | CVE Modified | [email protected] |
| Aug 19, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | [email protected] |
| Aug 3, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | New CVE Received | [email protected] |