7.1
High
CVE-2026-19816 A flaw was found in PackageKit
Description
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fedora 1.3 | 1.3.4 → < 1.4.0 | 1.4.0 |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published |
References
- github.com github.com
- github.com github.com
- bugzilla.redhat.com bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Fedora
The 83 CVEs of Fedora →
CVE-2026-94422
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass…
8.8
High
CVE-2026-19624
A flaw was found in NetworkManager-l2tp
7.8
High
CVE-2023-4235
A flaw was found in ofono, an Open Source Telephony on Linux
8.1
High
CVE-2023-4234
A flaw was found in ofono, an Open Source Telephony on Linux
8.1
High