Every CVE Search/ Get API key

CVE-2026-4948

Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization

5.5 MediumFix available

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.13%Up 0.1 points since Mar 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
CVE-2026-4948
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-279
Updated
2026-11-05
EUVDEUVD-2026-16557 5.5

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
EUVD-2026-16557
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-mxjh-5564-f256 5.5

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis...

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
GHSA-mxjh-5564-f256
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-279
Updated
2026-11-02
NVD 5.5

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
CVE-2026-4948
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-279
Updated
2026-11-05
OSVDEBIAN-CVE-2026-4948 5.5

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
DEBIAN-CVE-2026-4948
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1855 5.5

firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.(CVE-2026-4948)

Record
OESA-2026-1855
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 23 moreShow less
OSVOESA-2026-1856 5.5

firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.(CVE-2026-4948)

Record
OESA-2026-1856
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1857 5.5

firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.(CVE-2026-4948)

Record
OESA-2026-1857
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1858 5.5

firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.(CVE-2026-4948)

Record
OESA-2026-1858
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1859 5.5

firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.(CVE-2026-4948)

Record
OESA-2026-1859
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHBA-2026:28238 5.5

Red Hat Bug Fix Advisory: firewalld bug fix and enhancement update

Record
RHBA-2026:28238
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67585 5.5

Red Hat Security Advisory: firewalld security update

Record
RHSA-2026:67585
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67843 5.5

Red Hat Security Advisory: firewalld security update

Record
RHSA-2026:67843
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:76844 5.5

Red Hat Security Advisory: firewalld security update

Record
RHSA-2026:76844
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:67585 5.5

Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

  • firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization (CVE-2026-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67585
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-4948 5.5

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
UBUNTU-CVE-2026-4948
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:67585 No score

Moderate: firewalld security update

firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface.

Security Fix(es):

  • firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization (CVE-2026-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67585
Updated
2026-11-02
OSVAZL-85335 No score

CVE-2026-4948 affecting package firewalld for versions less than 2.0.2-4

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

Record
AZL-85335
Updated
2026-11-05
OSVCLSA-2026-1778887961 No score

firewalld: Fix of CVE-2026-4948

  • CVE-2026-4948: use PK_ACTION_CONFIG for setZoneSettings2/setPolicySettings to require write authorization
Record
CLSA-2026-1778887961
Updated
2026-11-02
OSVCLSA-2026-1779124021 No score

firewalld: Fix of CVE-2026-4948

  • CVE-2026-4948: use PK_ACTION_CONFIG instead of PK_ACTION_CONFIG_INFO for setZoneSettings2 and setPolicySettings to require config-write authorization
Record
CLSA-2026-1779124021
Updated
2026-11-02
OSVopenSUSE-SU-2026:11289-1 No score

firewall-applet-2.3.2-2.1 on GA media

These are all security issues fixed in the firewall-applet-2.3.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11289-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21032-1 No score

Security update for firewalld

This update for firewalld fixes the following issue

  • CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations (bsc#1260903).
Record
openSUSE-SU-2026:21032-1
Updated
2026-11-02
OSVSUSE-SU-2026:1872-1 No score

Security update for firewalld

This update for firewalld fixes the following issue:

  • CVE-2026-4948: local unprivileged users can modify the runtime firewall state without proper authentication due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:1872-1
Updated
2026-11-02
OSVSUSE-SU-2026:21418-1 No score

Security update for firewalld

This update for firewalld fixes the following issues:

  • CVE-2026-4948: local unprivileged users can modify the runtime firewall state without proper authentication due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:21418-1
Updated
2026-11-02
OSVSUSE-SU-2026:22060-1 No score

Security update for firewalld

This update for firewalld fixes the following issue

  • CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:22060-1
Updated
2026-11-02
OSVSUSE-SU-2026:22263-1 No score

Security update for firewalld

This update for firewalld fixes the following issue

  • CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:22263-1
Updated
2026-11-02
OSVSUSE-SU-2026:22343-1 No score

Security update for firewalld

This update for firewalld fixes the following issue

  • CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:22343-1
Updated
2026-11-02
OSVSUSE-SU-2026:2302-1 No score

Security update for firewalld

This update for firewalld fixes the following issue:

  • CVE-2026-4948: local unprivileged users can modify the runtime firewall state without proper authentication due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:2302-1
Updated
2026-11-02
OSVSUSE-SU-2026:2745-1 No score

Security update for firewalld-legacy

This update for firewalld-legacy fixes the following issue

  • CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations (bsc#1260903).
Record
SUSE-SU-2026:2745-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firewall-applet
AlmaLinux:9
 before 1.3.4-20.el9_8
1.3.4-20.el9_8
firewall-config
AlmaLinux:9
 before 1.3.4-20.el9_8
1.3.4-20.el9_8
firewalld
AlmaLinux:9
 before 1.3.4-20.el9_8
1.3.4-20.el9_8
firewalld-filesystem
AlmaLinux:9
 before 1.3.4-20.el9_8
1.3.4-20.el9_8
python3-firewall
AlmaLinux:9
 before 1.3.4-20.el9_8
1.3.4-20.el9_8
firewalld
Azure Linux:3
 before 2.0.2-4
2.0.2-4
firewall-applet
TuxCare:AlmaLinux:9.2
 before 1.2.1-1.el9_2.tuxcare.els1
1.2.1-1.el9_2.tuxcare.els1
firewall-config
TuxCare:AlmaLinux:9.2
 before 1.2.1-1.el9_2.tuxcare.els1
1.2.1-1.el9_2.tuxcare.els1
firewalld
TuxCare:AlmaLinux:9.2
 before 1.2.1-1.el9_2.tuxcare.els1
1.2.1-1.el9_2.tuxcare.els1
firewalld-filesystem
TuxCare:AlmaLinux:9.2
 before 1.2.1-1.el9_2.tuxcare.els1
1.2.1-1.el9_2.tuxcare.els1
Show 54 moreShow less
Affected packages
PackageAffectedFixed
python3-firewall
TuxCare:AlmaLinux:9.2
 before 1.2.1-1.el9_2.tuxcare.els1
1.2.1-1.el9_2.tuxcare.els1
firewall-applet
TuxCare:AlmaLinux:9.6
 before 1.3.4-15.el9_6.tuxcare.els1
1.3.4-15.el9_6.tuxcare.els1
firewall-config
TuxCare:AlmaLinux:9.6
 before 1.3.4-15.el9_6.tuxcare.els1
1.3.4-15.el9_6.tuxcare.els1
firewalld
TuxCare:AlmaLinux:9.6
 before 1.3.4-15.el9_6.tuxcare.els1
1.3.4-15.el9_6.tuxcare.els1
firewalld-filesystem
TuxCare:AlmaLinux:9.6
 before 1.3.4-15.el9_6.tuxcare.els1
1.3.4-15.el9_6.tuxcare.els1
python3-firewall
TuxCare:AlmaLinux:9.6
 before 1.3.4-15.el9_6.tuxcare.els1
1.3.4-15.el9_6.tuxcare.els1
firewalld
Debian:12
 before 1.3.3-1~deb12u2, plus listed versions
1.3.0-11.3.1-11.3.2-11.3.3-1~deb12u1
1.3.3-1~deb12u2
firewalld
Debian:13
 before 2.3.1-1+deb13u1, plus listed versions
2.3.1-1
2.3.1-1+deb13u1
firewalld
Debian:14
 before 2.4.0-2, plus listed versions
2.3.1-12.3.1-22.3.1-32.4.0-1
2.4.0-2
firewalld
openEuler:24.03-LTS
 before 1.2.6-8.oe2403
1.2.6-8.oe2403
firewalld
openEuler:24.03-LTS-SP1
 before 1.2.6-9.oe2403sp1
1.2.6-9.oe2403sp1
firewalld
openEuler:24.03-LTS-SP2
 before 1.2.6-9.oe2403sp2
1.2.6-9.oe2403sp2
firewalld
openEuler:24.03-LTS-SP3
 before 1.2.6-9.oe2403sp3
1.2.6-9.oe2403sp3
firewalld
openEuler:22.03-LTS-SP4
 before 1.0.2-13.oe2203sp4
1.0.2-13.oe2203sp4
firewall-applet
Red Hat:enterprise_linux:10.2
 before 0:2.4.2-1.el10_2
0:2.4.2-1.el10_2
firewall-config
Red Hat:enterprise_linux:10.2
 before 0:2.4.2-1.el10_2
0:2.4.2-1.el10_2
firewalld
Red Hat:enterprise_linux:10.2
 before 0:2.4.2-1.el10_2
0:2.4.2-1.el10_2
firewalld-filesystem
Red Hat:enterprise_linux:10.2
 before 0:2.4.2-1.el10_2
0:2.4.2-1.el10_2
python3-firewall
Red Hat:enterprise_linux:10.2
 before 0:2.4.2-1.el10_2
0:2.4.2-1.el10_2
firewall-applet
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
firewall-config
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
firewalld
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
firewalld-filesystem
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
python3-firewall
Red Hat:enterprise_linux:9::baseos
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
firewall-applet
Red Hat:enterprise_linux_eus:10.0
 before 0:2.3.1-1.el10_0.1
0:2.3.1-1.el10_0.1
firewall-config
Red Hat:enterprise_linux_eus:10.0
 before 0:2.3.1-1.el10_0.1
0:2.3.1-1.el10_0.1
firewalld
Red Hat:enterprise_linux_eus:10.0
 before 0:2.3.1-1.el10_0.1
0:2.3.1-1.el10_0.1
firewalld-filesystem
Red Hat:enterprise_linux_eus:10.0
 before 0:2.3.1-1.el10_0.1
0:2.3.1-1.el10_0.1
python3-firewall
Red Hat:enterprise_linux_eus:10.0
 before 0:2.3.1-1.el10_0.1
0:2.3.1-1.el10_0.1
firewall-applet
Red Hat:rhel_eus:9.6::appstream
 before 0:1.3.4-15.el9_6.1
0:1.3.4-15.el9_6.1
firewall-config
Red Hat:rhel_eus:9.6::appstream
 before 0:1.3.4-15.el9_6.1
0:1.3.4-15.el9_6.1
firewalld
Red Hat:rhel_eus:9.6::baseos
 before 0:1.3.4-15.el9_6.1
0:1.3.4-15.el9_6.1
firewalld-filesystem
Red Hat:rhel_eus:9.6::baseos
 before 0:1.3.4-15.el9_6.1
0:1.3.4-15.el9_6.1
python3-firewall
Red Hat:rhel_eus:9.6::baseos
 before 0:1.3.4-15.el9_6.1
0:1.3.4-15.el9_6.1
firewalld
Rocky Linux:9
 before 0:1.3.4-20.el9_8
0:1.3.4-20.el9_8
rpcbind
SUSE:Linux Micro 6.0
 before 1.2.9-1.1
1.2.9-1.1
firewalld
SUSE:Linux Micro 6.1
 before 2.0.0-slfo.1.1_2.1
2.0.0-slfo.1.1_2.1
firewalld
SUSE:Linux Micro 6.2
 before 2.1.2-160000.3.1
2.1.2-160000.3.1
firewalld
SUSE:Linux Enterprise Server 16.0
 before 2.1.2-160000.3.1
2.1.2-160000.3.1
firewalld
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.1.2-160000.3.1
2.1.2-160000.3.1
firewalld
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.3.4-150600.13.6.1
1.3.4-150600.13.6.1
firewalld
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 1.3.4-150600.13.6.1
1.3.4-150600.13.6.1
firewalld
SUSE:Linux Enterprise Module for Development Tools 15 SP7
 before 1.3.4-150600.13.6.1
1.3.4-150600.13.6.1
firewalld
SUSE:Linux Enterprise Module for Python 3 15 SP7
 before 1.3.4-150600.13.6.1
1.3.4-150600.13.6.1
firewalld
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.3.13-10.3.14.2-10.3.14.2-20.4.0-10.4.0-1ubuntu0.1
 None known
firewalld
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.4.4.5-20.4.4.6-1
 None known
firewalld
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.7.1-1ubuntu90.7.2-10.8.0-10.8.0-20.8.1-10.8.2-1
 None known
firewalld
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.3-2ubuntu11.0.1-2ubuntu41.0.2-1ubuntu11.0.3-1ubuntu21.1.0-1ubuntu11.1.0-1ubuntu31.1.0-1ubuntu41.1.1-1ubuntu1
 None known
firewalld
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.3.3-12.0.1-12.0.1-22.0.2-12.1.0-12.1.1-1
 None known
firewalld
Ubuntu:25.10
 All versions, plus listed versions
2.3.0-22.3.0-32.3.0-42.3.1-12.3.1-22.3.1-2ubuntu1
 None known
firewalld
Ubuntu:26.10
 All versions, plus listed versions
2.3.1-32.5.0-12.5.1-12.5.1-22.5.2-1
 None known
firewalld
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.3.1-2ubuntu12.3.1-3
 None known
firewalld
openSUSE:Tumbleweed
 before 2.3.2-2.1
2.3.2-2.1
firewalld
openSUSE:Leap 16.0
 before 2.1.2-160000.3.1
2.1.2-160000.3.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-4948 is a medium vulnerability (CVSS 5.5) in Firewalld, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in firewall-applet 1.3.4-20.el9_8.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open