CVE-2026-7837: Netatalk TOCTOU race condition in ad_flush

CVE-2026-7837 · Severity: low · CVSS 3.7 · Published 2026-05-21

Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used to share files with Apple computers, contains a minor security flaw in how it handles file metadata. Under very specific and difficult-to-replicate timing conditions, a remote attacker might be able to cause limited, unauthorized changes to file data. While the risk is considered low and the vendor has been unable to reproduce a full exploit, it represents a potential integrity risk to files stored on the server.

Technologies: Netatalk. Vendors: Netatalk.

Quick answers

Is CVE-2026-7837 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7837 being exploited in the wild.
How severe is CVE-2026-7837?
Low severity, with a CVSS score of 3.7, published 21 May 2026.
Which products and versions are affected?
Netatalk 3.0.0 - 4.4.2.
Is there a fix for CVE-2026-7837?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7837 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7837?
Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-of-check time-of-use (TOCTOU) vulnerability exists in the ad_flush function of Netatalk versions 3.0.0 through 4.4.2. The issue stems from how AppleDouble metadata is flushed; the process changes the working directory and elevates privileges to root before applying metadata to the current directory ('.') by path. This creates a race condition where the underlying file or directory could be swapped between the time of the check and the time of the privileged operation. Although the vendor reported difficulty in reproducing the exploit, the implementation has been hardened to avoid path-based ambiguity. A patch is available, and the issue is addressed in version 4.5.0.

Affected products

  • Netatalk Netatalk 3.0.0 - 4.4.2

Timeline

  • 2026-05-13: disclosed: Initial disclosure date reported by vendor
  • 2026-05-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.