CVE-2026-19816
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
CVE-2026-19816- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-78063
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
EUVD-2026-78063- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
NVD
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
CVE-2026-19816- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
CVE-2026-19816- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-19816
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
DEBIAN-CVE-2026-19816- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19816
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
- Record
UBUNTU-CVE-2026-19816- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11855-1 No score
PackageKit-1.4.0-1.1 on GA media
These are all security issues fixed in the PackageKit-1.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11855-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
packagekitDebian:12 |
All versions, plus listed versions 1.2.6-51.2.6-5+deb12u11.2.7-11.2.8-11.2.8-2 Show 11 moreShow less1.3.0-11.3.0-21.3.0-31.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:13 |
All versions, plus listed versions 1.3.1-11.3.1-1+deb13u11.3.2-11.3.3-11.3.4-1 Show 4 moreShow less1.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:14 |
before 1.4.0-1, plus listed versions 1.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-11.3.6-1 |
1.4.0-1 |
PackageKitopenSUSE:Tumbleweed |
before 1.4.0-1.1 | 1.4.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19816 is a high vulnerability (CVSS 7.1) in Fedora, published September 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in packagekit 1.4.0-1.
References
github.com/PackageKit/PackageKit/commit/33be77b3ecd3b566ca117358dc18c58c964e627b
bugzilla.redhat.com/show_bug.cgi?id=2515940
access.redhat.com/downloads/content/package-browser
bodhi.fedoraproject.org/updates?packages=PackageKit