# CVE-2026-44944: open-iscsi incorrect authorization in iscsiuio control socket

Source: https://junglewise.ai/threats/cve-2026-44944-open-iscsi-incorrect-authorization-in-iscsiuio-control-socket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-44944 · Severity: info · CVSS 8.5 · Published 2026-07-29

A security vulnerability has been identified in open-iscsi, a tool used to connect Linux systems to network storage. An unauthorized local user could gain control over the storage interface, potentially allowing them to disrupt storage services or access sensitive data. This could lead to a complete compromise of the system's storage operations and data integrity.

Technologies: [Open-iSCSI Project Open-Iscsi](https://junglewise.ai/threats/technologies/open-iscsi). Vendors: [Open-iSCSI Project](https://junglewise.ai/threats/vendors/open-iscsi-project).

## Quick answers

**Is CVE-2026-44944 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44944 being exploited in the wild.

**How severe is CVE-2026-44944?** Informational severity, with a CVSS score of 8.5, published 29 July 2026.

**Which products and versions are affected?** Open-iSCSI Project Open-Iscsi up to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

**Is there a fix for CVE-2026-44944?** A patch was published on 2026-07-29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44944 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44944?** Check whether you run Open-iSCSI Project Open-Iscsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the iscsiuio component of open-iscsi. The issue stems from a failure to properly verify credentials on the control socket, specifically by failing to validate connections against the correct file descriptor. A local, unprivileged attacker can exploit this to interact with the iscsiuio control socket, which typically requires elevated privileges. This allows the attacker to drive the interface, potentially leading to unauthorized storage configuration or data access. The issue is addressed in commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

## Affected products

- open-iscsi open-iscsi up to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

## Timeline

- 2026-07-29: advisory
- 2026-07-29: patched

## References

- [https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943)
- [https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e](https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e)

## Related threats

- [open-iscsi iscsiuio DHCPv6 parser buffer over-read](https://junglewise.ai/threats/cve-2026-115485-a-flaw-was-found-in-the-iscsiuio-component-of-open-iscsi-the)
- [open-iscsi Double Free in open-isns attrs.c](https://junglewise.ai/threats/cve-2026-55995-open-iscsi-double-free-in-open-isns-attrs-c)
- [open-iscsi path traversal in discovery IQN handling](https://junglewise.ai/threats/cve-2026-44943-open-iscsi-path-traversal-in-discovery-iqn-handling)