UBUNTU-CVE-2026-104619: Medium severity ubuntu/packagekit vulnerability
Published Nov 12, 2026
·Updated
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
Affected Software
7 affected components
ubuntu/packagekit*
ubuntu/packagekit*
ubuntu/packagekit*
ubuntu/packagekit*
ubuntu/packagekit*
ubuntu/packagekit*
ubuntu/packagekit*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PackageKit Zypp Backendto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue requires an untrusted user who can use the PackageKit Zypp Backend. Such a user could roll back security updates and use that rollback to escalate privileges.
2
Which backend versions are affected?
PackageKit Zypp Backend versions before 1.4.1 are affected. Version 1.4.1 or later is not identified as affected by the provided information.