CVE-2026-123177
HIGH
NVD
CVSS Score
8.4
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.