Quick answers
- Is CVE-2026-109970 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109970 being exploited in the wild.
- How severe is CVE-2026-109970?
- Medium severity, with a CVSS score of 4.7, published 14 October 2026.
- Which products and versions are affected?
- Clevis.
- Is there a fix for CVE-2026-109970?
- No fixed version is recorded yet. Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask of 0077 using systemctl edit, which prevents non-root users from reading the PIN file. This mitigation only covers the systemd service path; the dracut initramfs code path is not covered by this workaround. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-109970 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-109970?
- Check whether you run Clevis. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask of 0077 using systemctl edit, which prevents non-root users from reading the PIN file. This mitigation only covers the systemd service path; the dracut initramfs code path is not covered by this workaround.
Technical details
The clevis-luks-pkcs11-askpin script creates a temporary file containing the PKCS#11 token PIN without setting restrictive file permissions (umask), resulting in a world-readable file. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving credentials accessible indefinitely. Exploitation requires local access during boot to catch the timing window; the affected feature is opt-in and not enabled by default in standard clevis deployments.
Affected products
- Clevis
Timeline
- 2026-10-14: disclosed