Is CVE-2026-109971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109971 being exploited in the wild.

How severe is CVE-2026-109971?

Medium severity, with a CVSS score of 4.7, published 14 October 2026.

Is there a fix for CVE-2026-109971?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109971 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-109971?

Check whether you run Red Hat Clevis. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109971: Clevis PKCS#11 pin credential exposure on command line

CVE-2026-109971 · Severity: medium · CVSS 4.7 · Published 2026-10-14

Clevis is a key management tool that secures encrypted disks using hardware tokens. The PKCS#11 pin feature exposes the security token's PIN on the command line, where any local user can read it through system process listings or the /proc filesystem. An attacker with local access could potentially capture this PIN, though they would also need physical access to the corresponding PKCS#11 hardware token to exploit it.

Technologies: Red Hat Clevis. Vendors: Red Hat.

Quick answers

Is CVE-2026-109971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109971 being exploited in the wild.
How severe is CVE-2026-109971?: Medium severity, with a CVSS score of 4.7, published 14 October 2026.
Which products and versions are affected?: Red Hat Clevis.
Is there a fix for CVE-2026-109971?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109971 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-109971?: Check whether you run Red Hat Clevis. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, violating the principle of not exposing sensitive credentials in process arguments where they are visible via /proc or process listing tools. The vulnerability requires local access (low privilege user) and the PKCS#11 feature must be explicitly configured and in use; successful exploitation additionally requires physical access to the hardware token itself. The fix requires passing the PIN through an environment variable instead of the command line.

Affected products

Red Hat Clevis

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.