CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
Attackers can expose sensitive files like SSH keys by triggering permission changes on existing files when mkfifo fails to create a new FIFO.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35341?
CVE-2026-35341 is a high-severity missing authorization vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.
Weakness: CWE-732
Which versions are affected by CVE-2026-35341?
2 open source packages ship an affected version, including uu_mkfifo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uu_mkfifo crates.io | All versions | 0.6.0 |
uu_mkfifo crates.io | All versions | 0.6.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35341?
Upgrade uu_mkfifo to 0.6.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35341 being exploited?
There is no known exploitation of CVE-2026-35341 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
- CVE-2026-35350 uutils coreutils cp Unexpected Privileged Executable Creation with -p
Sources
Also known as DEBIAN-CVE-2026-35341, GHSA-pmf6-rcx4-v53v, UBUNTU-CVE-2026-35341.