Executive brief
A security flaw in the PluginScript component allows local users to bypass intended security restrictions. Under certain common configurations, the system fails to properly isolate plugin scripts, allowing them to access the entire host file system. This could allow an attacker to execute administrative commands and gain full control over the host operating system.
Technical details
The vulnerability exists in the PluginScript component's implementation of chroot isolation. When the 'repoManagerRoot' is configured as the system root ('/'), which occurs in standard configurations or when using the '--root' flag, the chroot operation becomes a no-op. This failure in filesystem isolation allows a malicious plugin to traverse paths and execute host binaries, such as /bin/bash, with root privileges. An attacker with local access can leverage this to achieve full system compromise. The issue is tracked as CVE-2026-44933 and was disclosed in May 2026.
Affected products
- SUSE PluginScript
Timeline
- 2026-05-20: disclosed