CVE-2026-10294
PackageKit API pk-transaction.c g_file_test improper authorization
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PackageKit API pk-transaction.c g_file_test improper authorization
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2026-10294- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R - CVSS 2.0
- 4.0
AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR - Weakness
- CWE-285, CWE-266
- Updated
- 2026-11-02
EUVDEUVD-2026-33818
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
EUVD-2026-33818- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9m6p-w8rp-5v54
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of...
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
GHSA-9m6p-w8rp-5v54- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-266
- Updated
- 2026-11-02
NVD
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2026-10294- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-266, CWE-285
- Updated
- 2026-11-02
OSV
PackageKit API pk-transaction.c g_file_test improper authorization
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
CVE-2026-10294- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-266, CWE-285
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-10294
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
DEBIAN-CVE-2026-10294- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 8 moreShow less
OSVOESA-2026-2689
PackageKit security update
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API.
Security Fix(es):
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.(CVE-2026-10294)
- Record
OESA-2026-2689- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-10294
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Record
UBUNTU-CVE-2026-10294- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0411 No score
Updated packagekit packages fix a security vulnerability
PackageKit API pk-transaction.c g_file_test improper authorization. (CVE-2026-10294)
- Record
MGASA-2026-0411- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11406-1 No score
PackageKit-1.3.6-1.1 on GA media
These are all security issues fixed in the PackageKit-1.3.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11406-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21425-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issues:
Security issue fixed:
- CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization (bsc#1267250).
Non security issue fixed:
- KDE Discover ignores package locks (bsc#1263252).
- Record
openSUSE-SU-2026:21425-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22860-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issues:
Security issue fixed:
- CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization (bsc#1267250).
Non security issue fixed:
- KDE Discover ignores package locks (bsc#1263252).
- Record
SUSE-SU-2026:22860-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3404-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issues:
- CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization (bsc#1267250).
- Record
SUSE-SU-2026:3404-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3405-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issue:
- CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization (bsc#1267250).
- Record
SUSE-SU-2026:3405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
packagekitDebian:12 |
All versions, plus listed versions 1.2.6-51.2.6-5+deb12u11.2.7-11.2.8-11.2.8-2 Show 11 moreShow less1.3.0-11.3.0-21.3.0-31.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:13 |
All versions, plus listed versions 1.3.1-11.3.1-1+deb13u11.3.2-11.3.3-11.3.4-1 Show 4 moreShow less1.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:14 |
before 1.3.6-1, plus listed versions 1.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-1 |
1.3.6-1 |
packagekitMageia:10 |
before 1.3.5-1.1.mga10 | 1.3.5-1.1.mga10 |
packagekitMageia:9 |
before 1.2.6-2.2.mga9 | 1.2.6-2.2.mga9 |
PackageKitopenEuler:24.03-LTS-SP1 |
before 1.2.8-6.oe2403sp1 | 1.2.8-6.oe2403sp1 |
PackageKitopenEuler:24.03-LTS-SP3 |
before 1.2.8-6.oe2403sp3 | 1.2.8-6.oe2403sp3 |
PackageKitopenEuler:20.03-LTS-SP4 |
before 1.1.12-12.oe2003sp4 | 1.1.12-12.oe2003sp4 |
PackageKitopenEuler:22.03-LTS-SP4 |
before 1.1.12-12.oe2203sp4 | 1.1.12-12.oe2203sp4 |
PackageKitSUSE:Linux Enterprise Server 16.0 |
before 1.2.8-160000.5.1 | 1.2.8-160000.5.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
PackageKitSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 1.2.8-160000.5.1 | 1.2.8-160000.5.1 |
PackageKitSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 1.2.8-150600.4.17.1 | 1.2.8-150600.4.17.1 |
PackageKitSUSE:Linux Enterprise Workstation Extension 15 SP7 |
before 1.2.8-150600.4.17.1 | 1.2.8-150600.4.17.1 |
PackageKitSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 1.1.3-24.26.1 | 1.1.3-24.26.1 |
packagekitUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.17-4ubuntu6~gcc5.30.8.17-4ubuntu6~gcc5.4ubuntu10.8.17-4ubuntu6~gcc5.4ubuntu1.10.8.17-4ubuntu6~gcc5.4ubuntu1.20.8.17-4ubuntu6~gcc5.4ubuntu1.30.8.17-4ubuntu6~gcc5.4ubuntu1.40.8.17-4ubuntu6~gcc5.4ubuntu1.50.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 |
None known |
packagekitUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.7-11.1.9-11.1.9-1ubuntu11.1.9-1ubuntu21.1.9-1ubuntu2.18.04.1 Show 5 moreShow less1.1.9-1ubuntu2.18.04.31.1.9-1ubuntu2.18.04.41.1.9-1ubuntu2.18.04.51.1.9-1ubuntu2.18.04.61.1.9-1ubuntu2.18.04.6+esm1 |
None known |
packagekitUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.12-5ubuntu41.1.13-11.1.13-21.1.13-2build11.1.13-2ubuntu11.1.13-2ubuntu1.11.1.13-2ubuntu1.1+esm1 |
None known |
packagekitUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.2-2ubuntu31.2.4-1ubuntu11.2.4-1ubuntu21.2.5-1ubuntu11.2.5-2ubuntu11.2.5-2ubuntu21.2.5-2ubuntu31.2.5-2ubuntu3.1 |
None known |
packagekitUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.7-11.2.8-11.2.8-1build11.2.8-21.2.8-2build2 Show 6 moreShow less1.2.8-2build31.2.8-2ubuntu11.2.8-2ubuntu1.11.2.8-2ubuntu1.21.2.8-2ubuntu1.41.2.8-2ubuntu1.5 |
None known |
packagekitUbuntu:25.10 |
All versions, plus listed versions 1.3.0-3build11.3.1-11.3.1-1ubuntu11.3.1-1ubuntu1.1 |
None known |
packagekitUbuntu:26.10 |
All versions, plus listed versions 1.3.4-31.3.5-11.3.5-1ubuntu11.3.6-11.3.6-1ubuntu1 |
None known |
packagekitUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.4-3ubuntu11.3.4-3ubuntu1.11.3.4-3ubuntu1.2 |
None known |
PackageKitopenSUSE:Tumbleweed |
before 1.3.6-1.1 | 1.3.6-1.1 |
PackageKitopenSUSE:Leap 16.0 |
before 1.2.8-160000.5.1 | 1.2.8-160000.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-10294 is a medium vulnerability (CVSS 5.3) in Packagekit, published June 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in packagekit 1.3.6-1.
References
vuldb.com/vuln/367587
github.com/PackageKit/PackageKit/issues/969
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-10294
security-tracker.debian.org/tracker/CVE-2026-10294
advisories.mageia.org/MGASA-2026-0411.html
bugs.mageia.org/show_bug.cgi?id=36166
lists.opensuse.org/archives/list/[email protected]/message/M6KYMZZSTVVP7SBKMB54MNOK7HGHQQN4
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2689
suse.com/support/update/announcement/2026/suse-su-202622860-1
bugzilla.suse.com/1263252
ubuntu.com/security/CVE-2026-10294
cve.org/CVERecord?id=CVE-2026-10294