CVE-2026-45767: Suricata datasets: save to absolute filename can be bypassed when combined with load command
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess load+ save rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.5
Event History
Frequently Asked Questions
Which deployments are affected?
Suricata versions earlier than 7.0.16 and 8.0.5 are affected. The issue is triggered when Suricata loads or reloads a malicious rule that combines dataset load and save commands.
What level of access does an attacker need?
An attacker needs the ability to introduce a malicious rule that Suricata will load or reload. Exploitation has high attack complexity and requires high privileges according to the supplied vector.
What can be done if upgrading is not immediately possible?
Preprocess rules containing both load and save commands to disallow absolute filenames in save operations. Also use Suricata privilege dropping to restrict writable files and/or configure Landlock in suricata.yaml.
What is the impact of successful exploitation?
A malicious rule could overwrite arbitrary files on the filesystem during rule loading or reloading. The supplied vector indicates integrity impact without confidentiality or availability impact.