CVE-2026-58015 Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A malicious D-Bus server can exploit a path traversal flaw in GLib's DBUS_COOKIE_SHA1 mechanism to read arbitrary files from the client system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58015?
CVE-2026-58015 is a medium-severity path traversal vulnerability in Redhat Enterprise Linux, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
Weakness: CWE-22
Which versions are affected by CVE-2026-58015?
It affects 2 products.
Products include Gnome Glib, Redhat Enterprise Linux.
How do I fix CVE-2026-58015?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58015 being exploited?
There is no known exploitation of CVE-2026-58015 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2020-35457 Integer overflow in n/a
- CVE-2009-3289 Privilege escalation in n/a
- CVE-2025-13601 Glib: integer overflow in in g_escape_uri_string()
- CVE-2026-58016 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
- CVE-2025-4056 Glib: glib crash after long command line
Sources
Also known as AZL-91430, BELL-CVE-2026-58015, DEBIAN-CVE-2026-58015, ECHO-0da1-91d0-b905, GHSA-hmpf-72wc-2r6x, JLSEC-2026-1248 and 5 more.