CVE-2026-4105 Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method
A local unprivileged user can escalate privileges to root by exploiting improper access control in the systemd-machined D-Bus method.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-4105?
CVE-2026-4105 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 13 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.
Weakness: CWE-284
Which versions are affected by CVE-2026-4105?
Linux distribution packages (2)
systemd SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 228-157.75.1 |
systemd SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 228-157.75.1 |
How do I fix CVE-2026-4105?
Apply the vendor's patch.
Is CVE-2026-4105 being exploited?
There is no known exploitation of CVE-2026-4105 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1776345550, DEBIAN-CVE-2026-4105, ECHO-230a-8355-8606, GHSA-4h6x-r8vx-3862, OESA-2026-1912, OESA-2026-1913 and 1 more.