# CVE-2026-54231: Red Hat libreport content injection in ABRT post-create scripts

Source: https://junglewise.ai/threats/cve-2026-54231-red-hat-libreport-content-injection-in-abrt-post-create-scripts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-13. Updated: 2026-06-13  
License: CC BY 4.0 with a link back

CVE-2026-54231 · Severity: medium · CVSS 5.5 · Published 2026-06-13

A vulnerability in the Automatic Bug Reporting Tool (ABRT) allows a local user to inject fake data into system crash reports. ABRT is used to collect and analyze information when software fails. By manipulating system logs, an attacker can force the system to write unauthorized content into administrative dump directories, potentially misleading administrators or corrupting diagnostic data.

Technologies: [Red Hat Abrt](https://junglewise.ai/threats/technologies/abrt). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-54231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54231 being exploited in the wild.

**How severe is CVE-2026-54231?** Medium severity, with a CVSS score of 5.5, published 13 June 2026.

**Which products and versions are affected?** Red Hat libreport; Red Hat ABRT (Automatic Bug Reporting Tool).

**Is there a fix for CVE-2026-54231?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54231 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-54231?** Check whether you run Red Hat Abrt or Red Hat Libreport. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A content injection vulnerability exists in the ABRT post-create event handler scripts within libreport. The scripts use journalctl to query systemd journal entries for crashed processes and write the output to files in the dump directory (e.g., var_log_messages) without sanitizing control characters. A local attacker can use prctl(PR_SET_NAME) to match a target process name and syslog() to inject messages containing newline characters. Because the script does not sanitize these embedded characters, the attacker can control the content written by the root user to files in the dump directory. This bypasses intended logging integrity and allows for the insertion of arbitrary data into administrative report files.

## Affected products

- Red Hat libreport
- Red Hat ABRT (Automatic Bug Reporting Tool)

## Timeline

- 2026-06-13: disclosed: NVD publication date
- 2026-06-12: advisory: Red Hat bugzilla entry created

## References

- [https://access.redhat.com/security/cve/CVE-2026-54231](https://access.redhat.com/security/cve/CVE-2026-54231)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2488571](https://bugzilla.redhat.com/show_bug.cgi?id=2488571)

## Related threats

- [Red Hat libreport symlink following in ABRT event handler scripts](https://junglewise.ai/threats/cve-2026-54230-red-hat-libreport-symlink-following-in-abrt-event-handler-scripts)
- [Red Hat abrt race condition in ChownProblemDir method](https://junglewise.ai/threats/cve-2026-54229-red-hat-abrt-race-condition-in-chownproblemdir-method)
- [Red Hat abrt TOCTOU race condition in abrt-dbus SetElement](https://junglewise.ai/threats/cve-2026-54228-red-hat-abrt-toctou-race-condition-in-abrt-dbus-setelement)