CVE-2026-58015: GLib path traversal in GDBus DBUS_COOKIE_SHA1 authentication

CVE-2026-58015 · Severity: medium · CVSS 5.9 · Published 2026-06-30

A security vulnerability has been identified in GLib, a core library used by many Linux-based applications to handle system communications. A malicious server can trick a client application into reading sensitive files from the user's computer by exploiting a flaw in how it handles authentication requests. This could allow an attacker to steal private data by verifying guessed file contents against cryptographic hashes sent back by the victim's system.

Technologies: Gnome Glib. Vendors: Gnome.

Quick answers

Is CVE-2026-58015 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58015 being exploited in the wild.
How severe is CVE-2026-58015?
Medium severity, with a CVSS score of 5.9, published 30 June 2026.
Which products and versions are affected?
Gnome Glib All versions implementing DBUS_COOKIE_SHA1 client-side authentication (including 2.87.2).
Is there a fix for CVE-2026-58015?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58015 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58015?
Check whether you run Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in GLib's GDBus implementation within `gio/gdbusauthmechanismsha1.c`. The client-side implementation of the `DBUS_COOKIE_SHA1` SASL mechanism fails to validate the `cookie_context` parameter provided by the server, despite D-Bus specifications forbidding path delimiters. An attacker-controlled D-Bus server can provide a crafted `cookie_context` (e.g., using `../` sequences) which `keyring_lookup_entry()` uses in `g_build_filename()` to access files outside the intended `~/.dbus-keyrings/` directory. The client reads the target file and incorporates a portion of its content into a SHA1 hash returned to the server. A remote attacker can then exfiltrate sensitive data by brute-forcing or verifying guessed file contents against the received hash. This is particularly relevant for D-Bus over TCP connections where `EXTERNAL` authentication is unavailable.

Affected products

  • GNOME GLib All versions implementing DBUS_COOKIE_SHA1 client-side authentication (including 2.87.2)
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-02-01: disclosed: Reported via YesWeHack to GNOME/GLib
  • 2026-06-30: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.