CVE-2026-4948 Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization
Local unprivileged users can modify firewall settings via D-Bus due to missing authorization checks, allowing unauthorized network configuration changes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4948?
CVE-2026-4948 is a medium-severity missing authorization vulnerability in Redhat Enterprise Linux, published on 27 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.
Weakness: CWE-279
Which versions are affected by CVE-2026-4948?
It affects 2 products.
Linux distribution packages (37)
firewall-applet AlmaLinux:9 | All versions | 1.3.4-20.el9_8 |
firewall-config AlmaLinux:9 | All versions | 1.3.4-20.el9_8 |
firewalld AlmaLinux:9 | All versions | 1.3.4-20.el9_8 |
firewalld-filesystem AlmaLinux:9 | All versions | 1.3.4-20.el9_8 |
python3-firewall AlmaLinux:9 | All versions | 1.3.4-20.el9_8 |
firewall-applet Red Hat:enterprise_linux:10.2 | All versions | 0:2.4.2-1.el10_2 |
firewall-config Red Hat:enterprise_linux:10.2 | All versions | 0:2.4.2-1.el10_2 |
firewalld Red Hat:enterprise_linux:10.2 | All versions | 0:2.4.2-1.el10_2 |
firewalld-filesystem Red Hat:enterprise_linux:10.2 | All versions | 0:2.4.2-1.el10_2 |
python3-firewall Red Hat:enterprise_linux:10.2 | All versions | 0:2.4.2-1.el10_2 |
firewall-applet Red Hat:enterprise_linux:9::appstream | All versions | 0:1.3.4-20.el9_8 |
firewall-config Red Hat:enterprise_linux:9::appstream | All versions | 0:1.3.4-20.el9_8 |
firewalld Red Hat:enterprise_linux:9::baseos | All versions | 0:1.3.4-20.el9_8 |
firewalld-filesystem Red Hat:enterprise_linux:9::baseos | All versions | 0:1.3.4-20.el9_8 |
python3-firewall Red Hat:enterprise_linux:9::baseos | All versions | 0:1.3.4-20.el9_8 |
firewall-applet Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.3.1-1.el10_0.1 |
firewall-config Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.3.1-1.el10_0.1 |
firewalld Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.3.1-1.el10_0.1 |
firewalld-filesystem Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.3.1-1.el10_0.1 |
python3-firewall Red Hat:enterprise_linux_eus:10.0 | All versions | 0:2.3.1-1.el10_0.1 |
firewall-applet Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.3.4-15.el9_6.1 |
firewall-config Red Hat:rhel_eus:9.6::appstream | All versions | 0:1.3.4-15.el9_6.1 |
firewalld Red Hat:rhel_eus:9.6::baseos | All versions | 0:1.3.4-15.el9_6.1 |
firewalld-filesystem Red Hat:rhel_eus:9.6::baseos | All versions | 0:1.3.4-15.el9_6.1 |
python3-firewall Red Hat:rhel_eus:9.6::baseos | All versions | 0:1.3.4-15.el9_6.1 |
firewalld Rocky Linux:9 | All versions | 0:1.3.4-20.el9_8 |
firewalld SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.3.4-150600.13.6.1 |
firewalld SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 1.3.4-150600.13.6.1 |
firewalld SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 1.3.4-150600.13.6.1 |
firewalld SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 1.3.4-150600.13.6.1 |
firewalld SUSE:Linux Enterprise Server 16.0 | All versions | 2.1.2-160000.3.1 |
firewalld SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.1.2-160000.3.1 |
rpcbind SUSE:Linux Micro 6.0 | All versions | 1.2.9-1.1 |
firewalld SUSE:Linux Micro 6.1 | All versions | 2.0.0-slfo.1.1_2.1 |
firewalld SUSE:Linux Micro 6.2 | All versions | 2.1.2-160000.3.1 |
firewalld openSUSE:Leap 16.0 | All versions | 2.1.2-160000.3.1 |
firewalld openSUSE:Tumbleweed | All versions | 2.3.2-2.1 |
Products include Firewalld Firewalld, Redhat Enterprise Linux.
How do I fix CVE-2026-4948?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-4948 being exploited?
There is no known exploitation of CVE-2026-4948 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as ALSA-2026:67585, AZL-85335, CLSA-2026-1778887961, CLSA-2026-1779124021, DEBIAN-CVE-2026-4948, GHSA-mxjh-5564-f256 and 20 more.