CVE-2026-45254

In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.freebsd.org/advisories/FreeBSD-SA-26:24.cap_net.asc	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:freebsd:freebsd:14.3:-::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p1::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p10::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p11::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p12::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p13::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p2::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p3::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p4::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p5::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p6::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p7::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p8::::::
	cpe:2.3:o:freebsd:freebsd:14.3:p9::::::
	cpe:2.3:o:freebsd:freebsd:14.4:-::::::
	cpe:2.3:o:freebsd:freebsd:14.4:p1::::::
	cpe:2.3:o:freebsd:freebsd:14.4:p2::::::
	cpe:2.3:o:freebsd:freebsd:14.4:p3::::::
	cpe:2.3:o:freebsd:freebsd:14.4:p4::::::
	cpe:2.3:o:freebsd:freebsd:14.4:rc1::::::
	cpe:2.3:o:freebsd:freebsd:15.0:-::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p1::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p2::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p3::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p4::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p5::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p6::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p7::::::
	cpe:2.3:o:freebsd:freebsd:15.0:p8::::::

History

No history.

Information

Published : 2026-05-21 10:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-45254

Mitre link : CVE-2026-45254

CVE.ORG link : CVE-2026-45254

JSON object : View

Products Affected

freebsd

freebsd

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-45254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-21T14:35:55.800907Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secteam@freebsd.org", "affectedData": [{"vendor": "FreeBSD", "modules": ["libcap_net"], "product": "FreeBSD", "versions": [{"status": "affected", "version": "15.0-RELEASE", "lessThan": "p9", "versionType": "release"}, {"status": "affected", "version": "14.4-RELEASE", "lessThan": "p5", "versionType": "release"}, {"status": "affected", "version": "14.3-RELEASE", "lessThan": "p14", "versionType": "release"}], "defaultStatus": "unknown"}]}], "published": "2026-05-21T10:16:26.380", "references": [{"url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:24.cap_net.asc", "tags": ["Vendor Advisory"], "source": "secteam@freebsd.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secteam@freebsd.org", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as \"allow any\" instead of being rejected.\n\nIn certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process."}, {"lang": "es", "value": "En el caso del servicio cap_net, cuando una clave presente en el l\u00edmite antiguo se omit\u00eda del nuevo l\u00edmite, la clave faltante se trataba como 'permitir cualquiera' en lugar de ser rechazada.\n\nEn ciertos escenarios, una aplicaci\u00f3n que hab\u00eda restringido previamente un subconjunto de operaciones de red podr\u00eda solicitar un nuevo l\u00edmite que extend\u00eda los permisos del proceso."}], "lastModified": "2026-07-23T16:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3D22B8C-36CF-4800-9673-0B0240558BDD"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7296F5AA-F8C1-4277-A4EE-C2B24073A320"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C30E4A9C-0594-4F40-92B3-26CB9AA85AE9"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F83F91B-587A-433C-99DB-0D63E267FF16"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44B9C2FC-756E-459F-8E68-C2C2B8C258AC"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "242FA2A8-5D7D-4617-A411-2651FF3A3E4C"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40573F60-F3B7-4AEC-846A-B08E5B7D9D00"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FB832CE-0A98-44A2-8BAC-CD38A64279B6"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A785F8E-C218-41AE-8D57-BF06DDAEF7CB"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3909FDD-B2A2-45B6-A40B-1D303A717F15"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "720597A2-F181-46E1-8A0D-097E17ADC4FB"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC8A75D0-148A-427A-9783-45477EABED21"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D39FC9-6DBA-46C8-BB80-A6188E6A8527"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0342A715-E211-4AF6-97ED-32EB9EBB947D"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"}, {"criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"}], "operator": "OR"}]}], "sourceIdentifier": "secteam@freebsd.org"}