CVE-2026-44943

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.

Security Fix(es):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.

Security Fix(es):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.

Security Fix(es):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.

This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44944)

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.

Security Fix(es):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.

Security Fix(es):

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.

Security Fix(es):

• open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)

• open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

Bug Fix(es) and Enhancement(s):

• [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [rhel-9.8.z] (JIRA:Rocky Linux-191897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.

Security Fix(es):

• open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)

• open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

Bug Fix(es) and Enhancement(s):

• [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [rhel-10.2.z] (JIRA:Rocky Linux-191899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.

Security Fix(es):

• open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)
• open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

Bug Fix(es) and Enhancement(s):

• [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-9.8.z] (JIRA:AlmaLinux-191897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.

Security Fix(es):

• open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)
• open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

Bug Fix(es) and Enhancement(s):

• [FJ10.1 Bug]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [almalinux-10.2.z] (JIRA:AlmaLinux-191899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

• CVE-2026-44943: path traversal via unvalidated IQN in discovery records
• CVE-2026-44944: iscsiuio control socket authorization bypass

• CVE-2026-44943: path traversal via unvalidated IQN in discovery records
• CVE-2026-44944: iscsiuio control socket authorization bypass

These are all security issues fixed in the iscsiuio-0.7.8.8-112.1 package on the GA media of openSUSE Tumbleweed.

This update for open-iscsi fixes the following issues:

Update to version 2.1.12.suse+0.8f77cf16:

• CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records (bsc#1268353).
• CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the isscsiuio control socket (bsc#1268352).

Changes for open-iscsi:

• Version 2.1.12.suse+0.8f77cf16:
  • Fix security issues recently discovered by Keith at Linneman Labs.
  • iscsi-init.service: use iscsi-gen-initiatorname.
  • iscsi-gen-initiatorname: use @IQN_PREFIX@ as default.
  • Avoid possible double free of found in idbm_rec_update_param.
  • iscsi: validate interface IP against target address family.

This update for open-iscsi fixes the following issues:

Update to version 2.1.12.suse+0.8f77cf16:

• CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records (bsc#1268353).
• CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the isscsiuio control socket (bsc#1268352).

Changes for open-iscsi:

• Version 2.1.12.suse+0.8f77cf16:
  • Fix security issues recently discovered by Keith at Linneman Labs.
  • iscsi-init.service: use iscsi-gen-initiatorname.
  • iscsi-gen-initiatorname: use @IQN_PREFIX@ as default.
  • Avoid possible double free of found in idbm_rec_update_param.
  • iscsi: validate interface IP against target address family.

This update for open-iscsi fixes the following issues:

Update to version 2.1.12.suse+0.8f77cf16:

• CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records (bsc#1268353).
• CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the isscsiuio control socket (bsc#1268352).

Changes for open-iscsi:

• Version 2.1.12.suse+0.8f77cf16:
  • Fix security issues recently discovered by Keith at Linneman Labs.
  • iscsi-init.service: use iscsi-gen-initiatorname.
  • iscsi-gen-initiatorname: use @IQN_PREFIX@ as default.
  • Avoid possible double free of found in idbm_rec_update_param.
  • iscsi: validate interface IP against target address family.

This update for open-iscsi fixes the following issues:

Update to version 2.1.12.suse+0.8f77cf16:

• CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records (bsc#1268353).
• CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the isscsiuio control socket (bsc#1268352).

Changes for open-iscsi:

• Version 2.1.12.suse+0.8f77cf16:
  • Fix security issues recently discovered by Keith at Linneman Labs.
  • iscsi-init.service: use iscsi-gen-initiatorname.
  • iscsi-gen-initiatorname: use @IQN_PREFIX@ as default.
  • Avoid possible double free of found in idbm_rec_update_param.
  • iscsi: validate interface IP against target address family.

This update for open-iscsi fixes the following issues:

• CVE-2026-44943: remote file-write as root via discovery (bsc#1268353).
• CVE-2026-44944: iscsiuio control-socket auth bypass (bsc#1268352).

Changes for open-iscsi:

• Update to version 2.1.12.suse+0.8f77cf16:

• Preparing for version 2.1.12 (#536)
• iscsi-init.service: Use iscsi-gen-initiatorname
• iscsi-gen-initiatorname use @IQN_PREFIX@ as default
• avoid possible double free of found in idbm_rec_update_param (#528)
• iscsi: validate interface IP against target address family (#527)

• Update to version 2.1.11.suse+88.8e0635b3:

• Make iface.example a doc file. (#526)
• Updated SPEC file to deliver iface.example as a %doc file, no longer in the database directory.

• Update to version 2.1.11.suse+85.4ef97a15:

• Fix unused variable warning in usr/io.c (#524)
• Remove old rpm subdirectory, no longer needed.
• Add tcp.congestion_control configuration option (#520)
• Small cleanups for firmware discovery. (#522)
• Fix incorrect parsing of node.discovery_type 'static' and 'fw' (#518)
• iscsi_net_util: avoid copying NULL pointers with strlcpy() (#515)
• iscsi: delay reconnect until interface has valid IP. (#511)

This update for open-iscsi fixes the following issues:

• CVE-2026-18724: Stack buffer overflow in idbm record parsing (bsc#1275171).
• CVE-2026-18725: Out-of-bounds access in iscsiuio ICMPv6 echo handling (bsc#1275258).
• CVE-2026-18726: Denial of service in iscsiuio Router Advertisement parsing (bsc#1275260).
• CVE-2026-18727: Integer underflow in iscsiuio DHCPv6 parsing (bsc#1275261).
• CVE-2026-18728: Integer underflow in iscsiuio IPv4 DHCP parsing (bsc#1275262).
• CVE-2026-44943: remote file-write as root via discovery (bsc#1268353).
• CVE-2026-44944: iscsiuio control-socket auth bypass (bsc#1268352).

Changes for open-iscsi:

• Update to version 2.1.13.suse+4.dc2446a1:

• iscsid: honor REPORT LUNS DATA HAS CHANGED again (#557)
• Convert shell scripts to POSIX sh (#552)
• Preparing for version 2.1.13
• iscsiuio: fix incorrect comparison of IPv6 subnet mask
• usr: verify IPC peer credentials before sending data
• login: fix infinite redirect loops with configurable limits
• iscsiuio: strengthen IPv6 payload length validation in uip_process()
• iscsiuio: strengthen DHCPv6 option parsing loop bound check
• iscsiuio: validate DHCPv6 IA_NA option lengths to prevent OOB reads
• usr: network code ioctl handling improvements
• fix typo in user-facing error message in verify_mode_params() (#548)
• gitignore: ignore generated build artifacts (#550)
• iscsiadm: handle getopt errors directly (#551)
• Fix iscsi_conn_iface_has_ip error handling (#531)
• Fix reopen log freq change (#542)
• iscsi_net_util: fix broken VLAN support in find_vlan_dev (#545)
• Fixes for CVEs CVE-2026-18724 - CVE-2026-18728 (#544)
• usr: fix '-Wdiscarded-qualifiers' warning in auth.c (#539)
• usr: Fix -Wdiscarded-qualifiers warning in iqn_name_valid (#537)
• iscsiuio: Fix -Waddress-of-packed-member (#534)

• Update to version 2.1.12.suse+0.8f77cf16:

• Preparing for version 2.1.12 (#536)
• iscsi-init.service: Use iscsi-gen-initiatorname
• iscsi-gen-initiatorname use @IQN_PREFIX@ as default
• avoid possible double free of found in idbm_rec_update_param (#528)
• iscsi: validate interface IP against target address family (#527)

• Update to version 2.1.11.suse+88.8e0635b3:

• Make iface.example a doc file. (#526)
• Updated SPEC file to deliver iface.example as a %doc file, no longer in the database directory.

• Update to version 2.1.11.suse+85.4ef97a15:

• Fix unused variable warning in usr/io.c (#524)
• Remove old rpm subdirectory, no longer needed.
• Add tcp.congestion_control configuration option (#520)
• Small cleanups for firmware discovery. (#522)
• Fix incorrect parsing of node.discovery_type 'static' and 'fw' (#518)
• iscsi_net_util: avoid copying NULL pointers with strlcpy() (#515)
• iscsi: delay reconnect until interface has valid IP. (#511)

• Update to version 2.1.11.suse+73.1723affc61eb:

• README for rpm build directory
• Fix issue with IPv6 adapter interfaces (#508, bsc#1240969)
• fwparam_ppc.c: Fix the calloc-transposed-args issue (#504)
• Makefile: fix 'No rule to make target 'iscsiuio/Makefile.in' issue (#506)
• Fix typo in initiator.c (#507)

• Fixed some issues in this changes file

• One date had incorrect format from 2014
• Two separator lines were formatted incrrectly

• Update to version 2.1.11.suse+66.13c070123738:

• Fix iscsid.conf NOP configuration (bsc#1240541)

• Change SPEC file so that open-iscsi lock files always go in /run/lock/iscsi (bsc#1239107)
• Update to version 2.1.11.suse+65.65365e1cdedb:

• doc: fixup iscsiadm man page option for -r (#501)
• Modify log function to print session id (#498)
• Fix minor typo ('authenticaton') (#500)
• Preparing for version 2.1.11 (#499)
• iscsid: Rate limit session reopen log messages (#492)
• IPv6 support for iBFT iSCSI boot (#493)
• Improve iscsiadm command line parsing messages (#494)
• More testing cleanup, and fix dprint test usage (#491)
• Fix a typo in test/README (#486)
• iscsid: Fix hang during login with scan=manual (#485)
• fix 4 issues…