# CVE-2026-109969: clevis PKCS#11 pin missing authentication on AF_UNIX sockets

Source: https://junglewise.ai/threats/cve-2026-109969-a-flaw-was-found-in-the-clevis-pkcs-11-pin-the-clevis-pkcs11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-109969 · Severity: medium · CVSS 4.7 · Published 2026-10-14

Clevis is a tool for automatic disk decryption that integrates with Linux systems. The PKCS#11 feature of clevis creates network sockets without proper access controls, allowing any local user with permissive settings to inject malicious encryption keys or intercept LUKS passphrases. This is only a practical risk in systems with permissive file permissions or in initramfs environments with non-standard configurations.

Technologies: [Clevis](https://junglewise.ai/threats/technologies/x-clevis).

## Quick answers

**Is CVE-2026-109969 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109969 being exploited in the wild.

**How severe is CVE-2026-109969?** Medium severity, with a CVSS score of 4.7, published 14 October 2026.

**Which products and versions are affected?** Clevis <UNKNOWN>.

**Is there a fix for CVE-2026-109969?** No fixed version is recorded yet. Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask by creating a service override using systemctl edit and setting UMask to 0077; this ensures sockets are only accessible by root, preventing unauthorized connections. Note that this mitigation only covers the systemd service path and does not cover the dracut initramfs code path. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109969 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-109969?** Check whether you run Clevis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask by creating a service override using systemctl edit and setting UMask to 0077; this ensures sockets are only accessible by root, preventing unauthorized connections. Note that this mitigation only covers the systemd service path and does not cover the dracut initramfs code path.

## Technical details

The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask (e.g., 0000 or in certain dracut initramfs configurations), local users with sufficient privileges can connect to the control socket to inject arbitrary device/key pairs or to the data socket to receive LUKS passphrases. Default systemd umask of 0022 renders this unexploitable, as AF_UNIX SOCK_STREAM requires write permission to connect.

## Affected products

- clevis <UNKNOWN>

## Timeline

- 2026-10-14: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-109969](https://access.redhat.com/security/cve/CVE-2026-109969)

## Related threats

- [Clevis PKCS#11 pin plaintext passphrase logging](https://junglewise.ai/threats/cve-2026-109968-a-flaw-was-found-in-the-clevis-pkcs-11-pin-the-clevis-pkcs11)
- [Clevis PKCS#11 pin world-readable token PIN exposure](https://junglewise.ai/threats/cve-2026-109970-a-flaw-was-found-in-the-clevis-pkcs-11-pin-the-clevis-luks)