CVE-2026-35341

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10020	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en uutils coreutils mkfifo permite la modificación no autorizada de permisos en archivos existentes. Cuando mkfifo no logra crear un FIFO porque ya existe un archivo en la ruta de destino, no logra terminar la operación para esa ruta y continúa ejecutando una llamada set_permissions subsiguiente. Esto resulta en que los permisos del archivo existente sean cambiados al modo predeterminado (a menudo 644 después de umask), exponiendo potencialmente archivos sensibles como claves privadas SSH a otros usuarios en el sistema.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35341

Mitre link : CVE-2026-35341

CVE.ORG link : CVE-2026-35341

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-35341", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35341", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T03:55:23.826443Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:36.060", "references": [{"url": "https://github.com/uutils/coreutils/issues/10020", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system."}, {"lang": "es", "value": "Una vulnerabilidad en uutils coreutils mkfifo permite la modificaci\u00f3n no autorizada de permisos en archivos existentes. Cuando mkfifo no logra crear un FIFO porque ya existe un archivo en la ruta de destino, no logra terminar la operaci\u00f3n para esa ruta y contin\u00faa ejecutando una llamada set_permissions subsiguiente. Esto resulta en que los permisos del archivo existente sean cambiados al modo predeterminado (a menudo 644 despu\u00e9s de umask), exponiendo potencialmente archivos sensibles como claves privadas SSH a otros usuarios en el sistema."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}