# CVE-2026-4948: firewalld incorrect authorization in D-Bus setters

Source: https://junglewise.ai/threats/cve-2026-4948-firewalld-incorrect-authorization-in-d-bus-setters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-4948 · Severity: medium · CVSS 5.5 · Published 2026-03-27

A security flaw in firewalld, a common tool used to manage network security on Linux systems, allows a local user without administrative privileges to change firewall settings. This could allow an unauthorized person to bypass network protections or modify security policies on a shared computer or server. The issue specifically affects systems using the 'desktop' profile where certain security checks are not strictly enforced.

Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian), [Redhat Enterprise Linux](https://junglewise.ai/threats/technologies/enterprise-linux). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-4948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4948 being exploited in the wild.

**How severe is CVE-2026-4948?** Medium severity, with a CVSS score of 5.5, published 27 March 2026.

**Which products and versions are affected?** firewalld firewalld <= 2.4.0; Red Hat Enterprise Linux 7.0; Debian Debian Linux 11.0 (bullseye).

**Is there a fix for CVE-2026-4948?** A patch was published on 2026-05-15: Debian released security update DLA-4585-1 for Debian 11 bullseye Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4948 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-4948?** Check whether you run Debian Linux, Firewalld or Redhat Enterprise Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in firewalld versions up to 2.4.0 where two runtime D-Bus setters, 'setZoneSettings2' and 'setPolicySettings', are incorrectly guarded by the PK_ACTION_CONFIG_INFO permission instead of a more restrictive administrative action. On systems where the default desktop policy is active, this allows a local unprivileged user to bypass authentication requirements. An attacker can exploit this to modify the active firewall configuration, potentially opening ports or changing security policies. The issue has been addressed in Debian 11 via version 0.9.3-2+deb11u1 and identified in Red Hat Enterprise Linux 7.0.

## Affected products

- firewalld firewalld <= 2.4.0
- Red Hat Enterprise Linux 7.0
- Debian Debian Linux 11.0 (bullseye)

## Timeline

- 2026-03-27: disclosed: Initial report and CVE assignment
- 2026-03-27: advisory: Red Hat published initial vulnerability details
- 2026-05-15: patched: Debian released security update DLA-4585-1 for Debian 11 bullseye

## References

- [https://access.redhat.com/security/cve/CVE-2026-4948](https://access.redhat.com/security/cve/CVE-2026-4948)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452086](https://bugzilla.redhat.com/show_bug.cgi?id=2452086)
- [https://lists.debian.org/debian-lts-announce/2026/05/msg00029.html](https://lists.debian.org/debian-lts-announce/2026/05/msg00029.html)

## Related threats

- [GIMP file-pix plugin stack overflow in PIX image processing](https://junglewise.ai/threats/cve-2026-78475-gimp-file-pix-plugin-stack-overflow-in-pix-image-processing)
- [A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of…](https://junglewise.ai/threats/cve-2026-58224-a-flaw-was-found-in-samba-s-ctdb-the-clustered-database-service)
- [A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a…](https://junglewise.ai/threats/cve-2026-73585-a-flaw-was-found-in-sblim-cmpi-base-insecure-temporary-file)
- [A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged…](https://junglewise.ai/threats/cve-2026-73584-a-flaw-was-found-in-sblim-sfcb-a-local-low-privileged-attacker)
- [A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization…](https://junglewise.ai/threats/cve-2026-73583-a-flaw-was-found-in-sblim-sfcb-a-local-attacker-with-access-to)