# CVE-2026-10294: PackageKit improper authorization in SetHints D-Bus method

Source: https://junglewise.ai/threats/cve-2026-10294-packagekit-improper-authorization-in-sethints-d-bus-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10294 · Severity: medium · CVSS 4.3 · Published 2026-06-01

PackageKit is a system service that allows users to manage software packages. A security flaw in its API allows an attacker to determine if specific files exist on the system, even if those files are in protected directories that the user should not be able to see. This could be used by a malicious actor to gather information about the system's configuration or installed software to plan further attacks.

Technologies: [PackageKit](https://junglewise.ai/threats/technologies/packagekit). Vendors: [PackageKit](https://junglewise.ai/threats/vendors/packagekit).

## Quick answers

**Is CVE-2026-10294 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10294 being exploited in the wild.

**How severe is CVE-2026-10294?** Medium severity, with a CVSS score of 4.3, published 1 June 2026.

**Which products and versions are affected?** PackageKit up to 1.3.5.

**Is there a fix for CVE-2026-10294?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10294 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10294?** Check whether you run PackageKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in PackageKit's `SetHints` D-Bus method within `src/pk-transaction.c`. The function `pk_transaction_set_hint` processes the `frontend-socket` parameter using `g_file_test()` with the `G_FILE_TEST_EXISTS` flag. Because PackageKit typically runs with root privileges, `g_file_test()` follows symbolic links as root. An unprivileged attacker can provide a path to a symlink pointing to a restricted file; if the method returns success, the target file exists, and if it returns a "does not exist" error, the file is absent. This creates a side-channel oracle for arbitrary file probing. The vulnerability is reachable via the D-Bus system bus.

## Affected products

- PackageKit PackageKit up to 1.3.5

## Timeline

- 2026-05-11: disclosed: Issue reported on PackageKit GitHub repository
- 2026-06-01: advisory: CVE-2026-10294 published

## References

- [https://github.com/PackageKit/PackageKit/](https://github.com/PackageKit/PackageKit/)
- [https://github.com/PackageKit/PackageKit/issues/969](https://github.com/PackageKit/PackageKit/issues/969)
- [https://vuldb.com/cve/CVE-2026-10294](https://vuldb.com/cve/CVE-2026-10294)
- [https://vuldb.com/submit/826470](https://vuldb.com/submit/826470)
- [https://vuldb.com/vuln/367587](https://vuldb.com/vuln/367587)
- [https://vuldb.com/vuln/367587/cti](https://vuldb.com/vuln/367587/cti)

## Related threats

- [PackageKit authorization bypass in dnf5 backend](https://junglewise.ai/threats/cve-2026-19816-packagekit-authorization-bypass-in-dnf5-backend)
- [PackageKit privilege escalation via TOCTOU race condition in pk-transaction.c](https://junglewise.ai/threats/cve-2026-41651-packagekit-privilege-escalation-via-toctou-race-condition-in-pk)