Is CVE-2026-54230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54230 being exploited in the wild.

How severe is CVE-2026-54230?

High severity, with a CVSS score of 7, published 13 June 2026.

Which products and versions are affected?

Red Hat libreport; Red Hat ABRT (Automatic Bug Reporting Tool).

Is there a fix for CVE-2026-54230?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-54230 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54230?

Check whether you run Red Hat Abrt or Red Hat Libreport. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54230: Red Hat libreport symlink following in ABRT event handler scripts

CVE-2026-54230 · Severity: high · CVSS 7 · Published 2026-06-13

A security vulnerability exists in the Automatic Bug Reporting Tool (ABRT), a system used to detect and analyze software crashes. A local attacker can trick the system into overwriting critical system files by replacing temporary crash report files with symbolic links. This could allow an attacker to gain elevated privileges or cause a complete system failure by corrupting essential configuration files.

Technologies: Red Hat Abrt. Vendors: Red Hat.

Quick answers

Is CVE-2026-54230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54230 being exploited in the wild.
How severe is CVE-2026-54230?: High severity, with a CVSS score of 7, published 13 June 2026.
Which products and versions are affected?: Red Hat libreport; Red Hat ABRT (Automatic Bug Reporting Tool).
Is there a fix for CVE-2026-54230?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-54230 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54230?: Check whether you run Red Hat Abrt or Red Hat Libreport. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A symlink following vulnerability (CWE-59) exists in the ABRT post-create event handler scripts within libreport, specifically in /etc/libreport/events.d/abrt_event.conf. The vulnerability is rooted in the use of shell redirections (e.g., '>' or '>>') which perform file operations without the O_NOFOLLOW flag. Because these scripts are executed by a shell process running as root (within the abrt_handle_event_t SELinux domain), they will follow symbolic links to their targets. An attacker with filesystem control over the dump directory can replace expected output files with symlinks to sensitive locations like /var/spool/cron/root, leading to arbitrary file overwrites and potential privilege escalation. This requires the attacker to have local access and the ability to manipulate files in the dump directory before the event handler executes.

Affected products

Red Hat libreport
Red Hat ABRT (Automatic Bug Reporting Tool)

Timeline

2026-06-12: disclosed: Reported via Red Hat Bugzilla
2026-06-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.