{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-41651 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-41651 is a high-severity vulnerability in PackageKit, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-41651 and fix it if it is affected.\n\nWhat it is: CVE-2026-41651 is a high-severity vulnerability in PackageKit, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-41651 in the wild and no public exploit code.\n\nAffected product: PackageKit. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-41651/ (Markdown: https://insights.sbomify.com/CVE-2026-41651/index.md)","id":"CVE-2026-41651","markdown":"https://insights.sbomify.com/CVE-2026-41651/index.md","name":"CVE-2026-41651","record":{"aliases":["ALSA-2026:11504","ALSA-2026:11635","ALSA-2026:19141","ALSA-2026:19354","CLSA-2026-1778773906","CLSA-2026-1779711412","DEBIAN-CVE-2026-41651","GHSA-f55j-vvr9-69xv","MGASA-2026-0180","OESA-2026-2140","RHSA-2026:11504","RHSA-2026:11635","RHSA-2026:17558","RHSA-2026:17560","RHSA-2026:17561","RHSA-2026:18024","RHSA-2026:18031","RHSA-2026:18036","RHSA-2026:19141","RHSA-2026:19354","RHSA-2026:19454","RHSA-2026:19601","RHSA-2026:22146","RLSA-2026:11504","RLSA-2026:11635","RLSA-2026:19141","RLSA-2026:19354","ROOT-OS-UBUNTU-2004-CVE-2026-41651","SUSE-SU-2026:1619-2","SUSE-SU-2026:1700-1","SUSE-SU-2026:1701-1","SUSE-SU-2026:1939-1","SUSE-SU-2026:21427-1","UBUNTU-CVE-2026-41651","USN-8195-1","USN-8195-3","openSUSE-SU-2026:10629-1","openSUSE-SU-2026:20646-1"],"analysis":{"component_type":"operating_system","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"PackageKit package manager","requires_auth":"low_privilege","summary":"Local unprivileged users can exploit a race condition in PackageKit to install arbitrary packages as root, leading to privilege escalation.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"packagekit","vendor":"packagekit_project"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"description":"PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5.\n\nA local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction-\u003ecached_transaction_flags`  combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`:\n1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction-\u003ecached_transaction_flags` without checking whether the transaction has already been  authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING.\n2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags.\n3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.","ecosystems":["AlmaLinux:10","AlmaLinux:8","AlmaLinux:9","Red Hat:enterprise_linux:10.2","Red Hat:enterprise_linux:8::appstream","Red Hat:enterprise_linux:8::crb","Red Hat:enterprise_linux:9::appstream","Red Hat:enterprise_linux:9::crb","Red Hat:enterprise_linux_eus:10.0","Red Hat:rhel_aus:8.4::appstream","Red Hat:rhel_aus:8.6::appstream","Red Hat:rhel_e4s:8.6::appstream","Red Hat:rhel_e4s:8.8::appstream","Red Hat:rhel_e4s:9.0::appstream","Red Hat:rhel_e4s:9.2::appstream","Red Hat:rhel_els:7","Red Hat:rhel_eus:9.4::appstream","Red Hat:rhel_eus:9.4::crb","Red Hat:rhel_eus:9.6::appstream","Red Hat:rhel_eus:9.6::crb","Red Hat:rhel_eus_long_life:8.4::appstream","Red Hat:rhel_tus:8.6::appstream","Red Hat:rhel_tus:8.8::appstream","Rocky Linux:10","Rocky Linux:8","Rocky Linux:9","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":"2026-04-23","github_poc":12,"max_poc_stars":127,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-04-23T08:57:29Z","kind":"github_poc","ref":"https://github.com/Vozec/CVE-2026-41651","stars":127,"title":null},{"date":"2026-09-28T19:03:34Z","kind":"github_poc","ref":"https://github.com/ZeroDayEvil/CVE-2026-41651","stars":24,"title":"🛡️ Official AI Security Tool module for CVE-2026-41651 (PackageKit TOCTOU Local Privilege Escalation / Pack2TheRoot Deep Dive Analysis \u0026 Audit Module)."},{"date":"2026-04-24T10:32:42Z","kind":"github_poc","ref":"https://github.com/baph00met/CVE-2026-41651","stars":17,"title":"CVE-2026-41651 — PackageKit TOCTOU LPE"},{"date":"2026-04-24T07:39:17Z","kind":"github_poc","ref":"https://github.com/0xredash/CVE-2026-41651","stars":13,"title":"CVE-2026-41651"},{"date":"2026-04-29T15:40:54Z","kind":"github_poc","ref":"https://github.com/shibaaa204/Pack2TheRoot","stars":11,"title":"Poc for Pack2TheRoot CVE-2026-41651"},{"date":"2026-04-23T23:11:39Z","kind":"github_poc","ref":"https://github.com/CipherCloak/CVE-2026-41651","stars":8,"title":null},{"date":"2026-04-25T03:29:30Z","kind":"github_poc","ref":"https://github.com/dinosn/pack2theroot-lab","stars":8,"title":"CTF-style Docker lab for CVE-2026-41651 (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation"},{"date":"2026-05-06T07:39:29Z","kind":"github_poc","ref":"https://github.com/mawussid/CVE-2026-41651-Python","stars":2,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root","id":"CVE-2026-41651","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":262,"n_references":5,"next":{"headline":"BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration","id":"CVE-2026-41653"},"packages":[{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/almalinux/PackageKit","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/almalinux/PackageKit-command-not-found","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib","purl":"pkg:rpm/almalinux/PackageKit-glib","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-devel","purl":"pkg:rpm/almalinux/PackageKit-glib-devel","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin","purl":"pkg:rpm/almalinux/PackageKit-gstreamer-plugin","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:10","fixed":["1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module","purl":"pkg:rpm/almalinux/PackageKit-gtk3-module","source":"ALSA-2026:19141"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/almalinux/PackageKit","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/almalinux/PackageKit-command-not-found","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-cron","purl":"pkg:rpm/almalinux/PackageKit-cron","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib","purl":"pkg:rpm/almalinux/PackageKit-glib","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-devel","purl":"pkg:rpm/almalinux/PackageKit-glib-devel","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin","purl":"pkg:rpm/almalinux/PackageKit-gstreamer-plugin","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:8","fixed":["1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module","purl":"pkg:rpm/almalinux/PackageKit-gtk3-module","source":"ALSA-2026:11635"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/almalinux/PackageKit","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/almalinux/PackageKit","source":"ALSA-2026:19354"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/almalinux/PackageKit-command-not-found","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/almalinux/PackageKit-command-not-found","source":"ALSA-2026:19354"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib","purl":"pkg:rpm/almalinux/PackageKit-glib","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib","purl":"pkg:rpm/almalinux/PackageKit-glib","source":"ALSA-2026:19354"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-devel","purl":"pkg:rpm/almalinux/PackageKit-glib-devel","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-devel","purl":"pkg:rpm/almalinux/PackageKit-glib-devel","source":"ALSA-2026:19354"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin","purl":"pkg:rpm/almalinux/PackageKit-gstreamer-plugin","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin","purl":"pkg:rpm/almalinux/PackageKit-gstreamer-plugin","source":"ALSA-2026:19354"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_7"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module","purl":"pkg:rpm/almalinux/PackageKit-gtk3-module","source":"ALSA-2026:11504"},{"ecosystem":"AlmaLinux:9","fixed":["1.2.6-2.el9_8"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module","purl":"pkg:rpm/almalinux/PackageKit-gtk3-module","source":"ALSA-2026:19354"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/redhat/PackageKit","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/redhat/PackageKit-command-not-found","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found-debuginfo","purl":"pkg:rpm/redhat/PackageKit-command-not-found-debuginfo","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-debuginfo","purl":"pkg:rpm/redhat/PackageKit-debuginfo","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-debugsource","purl":"pkg:rpm/redhat/PackageKit-debugsource","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib","purl":"pkg:rpm/redhat/PackageKit-glib","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-debuginfo","purl":"pkg:rpm/redhat/PackageKit-glib-debuginfo","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-glib-devel","purl":"pkg:rpm/redhat/PackageKit-glib-devel","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin","purl":"pkg:rpm/redhat/PackageKit-gstreamer-plugin","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gstreamer-plugin-debuginfo","purl":"pkg:rpm/redhat/PackageKit-gstreamer-plugin-debuginfo","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module","purl":"pkg:rpm/redhat/PackageKit-gtk3-module","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:10.2","fixed":["0:1.2.8-8.el10_2"],"introduced":["0"],"last_affected":[],"package":"PackageKit-gtk3-module-debuginfo","purl":"pkg:rpm/redhat/PackageKit-gtk3-module-debuginfo","source":"RHSA-2026:19141"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit","purl":"pkg:rpm/redhat/PackageKit","source":"RHSA-2026:11635"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found","purl":"pkg:rpm/redhat/PackageKit-command-not-found","source":"RHSA-2026:11635"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.1.12-8.el8_10"],"introduced":["0"],"last_affected":[],"package":"PackageKit-command-not-found-debuginfo","purl":"pkg:rpm/redhat/PackageKit-command-not-found-debuginfo","source":"RHSA-2026:11635"}],"prev":{"headline":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","id":"CVE-2026-41650"},"products":["PackageKit"],"published":"2026-04-22","related":[{"cvss_score":3.3,"headline":"Information disclosure in PackageKit","id":"CVE-2022-0987","kev_date_added":null,"published":"2022-06-28"},{"cvss_score":2.1,"headline":"Privilege escalation in n/a","id":"CVE-2013-1764","kev_date_added":null,"published":"2014-04-16"}],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-07-15","vendors":["PackageKit"]},"summary":"Local unprivileged users can exploit a race condition in PackageKit to install arbitrary packages as root, leading to privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-41651/"}