Is CVE-2026-44059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44059 being exploited in the wild.

How severe is CVE-2026-44059?

Medium severity, with a CVSS score of 4.5, published 21 May 2026.

Is there a fix for CVE-2026-44059?

A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44059 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-44059?

Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44059: Netatalk non-reentrant privilege toggle race condition

CVE-2026-44059 · Severity: medium · CVSS 4.5 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to allow non-Apple systems to act as file servers for Mac computers. A flaw in how the software manages user permissions could potentially allow a local user to interfere with security controls. While the risk of a remote attack is considered low, the issue weakens the overall security of the file server's privilege management system.

Technologies: Netatalk. Vendors: Netatalk.

Quick answers

Is CVE-2026-44059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44059 being exploited in the wild.
How severe is CVE-2026-44059?: Medium severity, with a CVSS score of 4.5, published 21 May 2026.
Which products and versions are affected?: Netatalk 2.2.5 through 4.4.2.
Is there a fix for CVE-2026-44059?: A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44059 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-44059?: Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Netatalk versions 2.2.5 through 4.4.2 contain a race condition (CWE-362) within its privilege-switching logic. The software utilizes shared global state for toggling privileges without adequate locking or support for nested execution. This non-reentrant behavior means that concurrent or nested calls to privilege-management functions could lead to inconsistent security states. While the maintainers have not identified a direct path for remote privilege escalation in standard afpd request handling, the flaw represents a failure in robust privilege separation. The issue is resolved in version 4.5.0.

Affected products

Netatalk Netatalk 2.2.5 through 4.4.2

Timeline

2026-05-13: disclosed
2026-05-21: advisory: NVD publication date
2026-05-21: patched: Fixed in version 4.5.0

References

https://netatalk.io/security/CVE-2026-44059

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.