CVE-2026-59680 yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute
Administrators viewing user password settings in YaST can trigger root command execution via malicious LDAP attributes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59680?
CVE-2026-59680 is a high-severity command injection vulnerability in SUSE yast2-users, published on 1 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping.
Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry.
This issue affects yast2-users through 5.0.8.
Which versions are affected by CVE-2026-59680?
Linux distribution packages (15)
yast2-users SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.4.17-150400.3.21.1 |
yast2-users SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.4.17-150400.3.21.1 |
yast2-users SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.5.8-150500.3.11.1 |
yast2-users SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.5.8-150500.3.11.1 |
yast2-users SUSE:Linux Enterprise Installer Updates 15 SP4 | All versions | 4.4.17-150400.3.21.1 |
yast2-users SUSE:Linux Enterprise Installer Updates 15 SP7 | All versions | 4.7.2-150700.3.8.1 |
yast2-users SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.7.2-150700.3.8.1 |
yast2-users SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.2.20-3.3.1 |
yast2-users SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.4.17-150400.3.21.1 |
yast2-users SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 4.5.8-150500.3.11.1 |
yast2-users SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 4.6.7-150600.3.6.1 |
yast2-users SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.2.20-3.3.1 |
yast2-users SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 4.5.8-150500.3.11.1 |
yast2-users SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 4.6.7-150600.3.6.1 |
yast2-users openSUSE:Tumbleweed | All versions | 5.0.9-1.1 |
How do I fix CVE-2026-59680?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-59680 being exploited?
There is no known exploitation of CVE-2026-59680 in the wild and no public exploit code.
Sources
Also known as GHSA-qvch-9vjh-pr6p, SUSE-SU-2026:3945-1, SUSE-SU-2026:3946-1, SUSE-SU-2026:3947-1, SUSE-SU-2026:3948-1, SUSE-SU-2026:3949-1 and 1 more.