CVE-2026-10294: PackageKit API pk-transaction.c g_file_test improper authorization
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function gfiletest of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
PackageKitfrom your environment.Uninstall PackageKit from systems where it is not required to eliminate the vulnerable component.
- Configuration
Restrict access to the PackageKit frontend socket (frontend-socket) so that only trusted local users/processes can connect; remove or block remote access to this socket where possible.
PackageKit frontend-socket-access = restricted - Compensating control
Block or restrict network access to the PackageKit API/management interfaces (including the frontend socket) using firewall rules or network ACLs so only trusted hosts can reach them.
- Operational
Monitor systems for exploitation attempts related to PackageKit (notably manipulation of the frontend-socket) and investigate any suspicious activity; apply vendor-supplied patches or updates as soon as they are available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10294?
CVE-2026-10294 has a medium severity rating of 4.3.
How do I fix CVE-2026-10294?
Updating to PackageKit version 1.3.6 or later addresses the vulnerability CVE-2026-10294.
What kind of attack can be executed using CVE-2026-10294?
CVE-2026-10294 allows for remote attacks due to improper authorization in the PackageKit API.
Which versions of PackageKit are affected by CVE-2026-10294?
PackageKit versions up to 1.3.5 are affected by CVE-2026-10294.
What component of PackageKit is vulnerable in CVE-2026-10294?
CVE-2026-10294 affects the g_file_test function in the src/pk-transaction.c component of the PackageKit API.