CVE-2026-111253 is a vulnerability in Red Hat Hummingbird
Published on November 5, 2026
Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.
Vulnerability Analysis
CVE-2026-111253 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 30 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-111253 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-111253
Want to know whenever a new CVE is published for Red Hat Hummingbird? stack.watch will email you.