{"id":"CVE-2026-44944","aliases":["ALSA-2026:53844","ALSA-2026:53845","AZL-94431","CLSA-2026-1787316164","CLSA-2026-1787396809","DEBIAN-CVE-2026-44944","EUVD-2026-50312","GHSA-jm64-8832-wmmq","OESA-2026-3339","RHSA-2026:53844","RHSA-2026:53845","RHSA-2026:60427","RHSA-2026:60428","RHSA-2026:62029","RLSA-2026:53844","RLSA-2026:53845","SUSE-SU-2026:23157-1","SUSE-SU-2026:23223-1","SUSE-SU-2026:23235-1","SUSE-SU-2026:3647-1","UBUNTU-CVE-2026-44944","openSUSE-SU-2026:21580-1"],"status":"published","title":"iscsiuio control-socket authentication bypass in open-iscsi","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00093,"percentile":0.00519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-07-29T13:04:50Z","modified":"2026-10-29T11:32:36Z","fixes":[{"ecosystem":"Azure Linux:3","package":"iscsi-initiator-utils","fixed_in":["2.1.12-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"open-iscsi","fixed_in":["2.1.8-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"open-iscsi","fixed_in":["2.1.12-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.9-1.gita65a472.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"iscsi-initiator-utils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.9-1.gita65a472.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.9-1.gita65a472.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.9-1.gita65a472.el9_6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.4-3.git2a8f9d8.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"iscsi-initiator-utils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.4-3.git2a8f9d8.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.4-3.git2a8f9d8.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1.4-3.git2a8f9d8.el9_2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-1+deb12u1"}]}],"versions":["2.1.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.11-1","2.1.11-1+deb13u1","2.1.11-1+deb13u2","2.1.11-2","2.1.11-3","2.1.11-4","2.1.11-5","2.1.11-6","2.1.12-1","2.1.12-2","2.1.13-1"]},{"source":"osv","ecosystem":"Debian:14","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-1"}]}],"versions":["2.1.11-1","2.1.11-2","2.1.11-3","2.1.11-4","2.1.11-5","2.1.11-6"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-17.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.9-1.gita65a472.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"iscsi-initiator-utils-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"iscsi-initiator-utils-iscsiuio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"iscsi-initiator-utils-iscsiuio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"python3-iscsi-initiator-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.4-3.git2a8f9d8.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"iscsi-initiator-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.1.11-1.git4b3e853.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-150700.57.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.873-3ubuntu7","2.0.873-3ubuntu8","2.0.873-3ubuntu9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.873-3ubuntu13","2.0.873+git0.3b4b4500-13ubuntu3","2.0.873+git0.3b4b4500-14ubuntu1","2.0.873+git0.3b4b4500-14ubuntu3","2.0.873+git0.3b4b4500-14ubuntu3.1","2.0.873+git0.3b4b4500-14ubuntu3.2","2.0.873+git0.3b4b4500-14ubuntu3.3","2.0.873+git0.3b4b4500-14ubuntu3.4","2.0.873+git0.3b4b4500-14ubuntu3.5","2.0.873+git0.3b4b4500-14ubuntu3.6","2.0.873+git0.3b4b4500-14ubuntu3.7","2.0.873+git0.3b4b4500-14ubuntu3.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.874-4ubuntu3","2.0.874-4ubuntu4","2.0.874-4ubuntu5","2.0.874-5ubuntu1","2.0.874-5ubuntu2","2.0.874-5ubuntu2.1","2.0.874-5ubuntu2.2","2.0.874-5ubuntu2.3","2.0.874-5ubuntu2.4","2.0.874-5ubuntu2.6","2.0.874-5ubuntu2.7","2.0.874-5ubuntu2.9","2.0.874-5ubuntu2.10","2.0.874-5ubuntu2.11","2.0.874-5ubuntu2.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.874-7.1ubuntu3","2.0.874-7.1ubuntu5","2.0.874-7.1ubuntu6","2.0.874-7.1ubuntu6.1","2.0.874-7.1ubuntu6.2","2.0.874-7.1ubuntu6.3","2.0.874-7.1ubuntu6.4","2.0.874-7.1ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.4-0ubuntu1","2.1.4-0ubuntu2","2.1.4-0ubuntu3","2.1.4-0ubuntu4","2.1.5-1ubuntu1","2.1.5-1ubuntu1.1","2.1.5-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.8-1ubuntu2","2.1.9-3ubuntu1","2.1.9-3ubuntu2","2.1.9-3ubuntu3","2.1.9-3ubuntu4","2.1.9-3ubuntu5.1","2.1.9-3ubuntu5.2","2.1.9-3ubuntu5.3","2.1.9-3ubuntu5.4","2.1.9-3ubuntu5.5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.11-3ubuntu3","2.1.11-5ubuntu1","2.1.11-5ubuntu4","2.1.11-5ubuntu5","2.1.11-5ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.11-1ubuntu3","2.1.11-3ubuntu1","2.1.11-3ubuntu2","2.1.11-3ubuntu3","2.1.11-3ubuntu3.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"open-iscsi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"multiple open source","product":"open-iscsi"},{"vendor":"open-iscsi","product":"open-iscsi"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44944","tags":["report","article"]},{"url":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","tags":["fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44944","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jm64-8832-wmmq"},{"url":"https://access.redhat.com/errata/RHSA-2026:53844","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44944","tags":["report"]},{"url":"https://bugzilla.redhat.com/2508412","tags":["report"]},{"url":"https://bugzilla.redhat.com/2508419","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-53844.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53845","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-53845.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787316164.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44943","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787396809.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44944.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44944","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55995","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508419","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53844.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44943","tags":["advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44944","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53845.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60427","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60427.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60428","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60428.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62029","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62029.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:53844","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:53845","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623157-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268352","tags":["report"]},{"url":"https://bugzilla.suse.com/1268353","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44944","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623235-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263647-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44944","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44944","title":"iscsiuio control-socket authentication bypass in open-iscsi","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:04:50.575Z","modified":"2026-07-29T14:00:52.512Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-50312","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:04:50Z","modified":"2026-07-29T14:00:52Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:30.152277Z"}],"ghsa":[{"id":"GHSA-jm64-8832-wmmq","title":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use...","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T15:31:11Z","modified":"2026-07-29T15:31:11Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-44944","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:18:46.113Z","modified":"2026-07-30T16:43:03.817Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:33.629616Z"}],"osv":[{"id":"CVE-2026-44944","title":"iscsiuio control-socket authentication bypass in open-iscsi","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:04:50.575Z","modified":"2026-10-28T11:10:59.773283937Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44944","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.       This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:18:46.113Z","modified":"2026-10-02T08:00:06.72660955Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-3339","title":"open-iscsi security update","description":"The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI.\r\n\r\nSecurity Fix(es):\n\nAn Improper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.\n\n\n\n\n\n\nThis issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44943)\n\nAn Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.(CVE-2026-44944)\n\nA Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.(CVE-2026-55995)","status":"published","published":"2026-08-13T13:59:58Z","modified":"2026-08-16T01:45:12.204732783Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:53844","title":"Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update","status":"published","published":"2026-08-12T10:16:38Z","modified":"2026-09-02T10:19:45Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53845","title":"Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update","status":"published","published":"2026-08-12T10:16:39Z","modified":"2026-09-02T10:19:45Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:60427","title":"Red Hat Security Advisory: iscsi-initiator-utils security update","status":"published","published":"2026-08-27T10:16:17Z","modified":"2026-09-02T10:21:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:60428","title":"Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update","status":"published","published":"2026-08-27T10:16:17Z","modified":"2026-09-02T10:21:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62029","title":"Red Hat Security Advisory: iscsi-initiator-utils security update","status":"published","published":"2026-09-02T10:22:18Z","modified":"2026-09-02T10:33:13.774514024Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:53844","title":"Important: iscsi-initiator-utils security, bug fix, and enhancement update","description":"The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.\n\nSecurity Fix(es):\n\n* open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)\n\n* open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)\n\nBug Fix(es) and Enhancement(s):\n\n* [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as \"fw\", although it should be \"static\". [rhel-9.8.z] (JIRA:Rocky Linux-191897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-12T06:06:45.472446Z","modified":"2026-08-12T06:30:03.114205309Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:53845","title":"Important: iscsi-initiator-utils security, bug fix, and enhancement update","description":"The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.\n\nSecurity Fix(es):\n\n* open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)\n\n* open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)\n\nBug Fix(es) and Enhancement(s):\n\n* [FJ10.1 Bug]: iscsiadm reports node.discovery_type as \"fw\", although it should be \"static\". [rhel-10.2.z] (JIRA:Rocky Linux-191899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-12T12:08:21.56722Z","modified":"2026-08-12T12:30:04.301674153Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-44944","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:18:00Z","modified":"2026-10-17T12:58:21.195009436Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"ALSA-2026:53844","title":"Important: iscsi-initiator-utils security, bug fix, and enhancement update","description":"The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.  \n\nSecurity Fix(es):  \n\n  * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)\n  * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as \"fw\", although it should be \"static\". [almalinux-9.8.z] (JIRA:AlmaLinux-191897)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-10-29T11:32:36.428093371Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:53845","title":"Important: iscsi-initiator-utils security, bug fix, and enhancement update","description":"The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.  \n\nSecurity Fix(es):  \n\n  * open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)\n  * open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * [FJ10.1 Bug]: iscsiadm reports node.discovery_type as \"fw\", although it should be \"static\". [almalinux-10.2.z] (JIRA:AlmaLinux-191899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-11T00:00:00Z","modified":"2026-10-29T11:30:28.915835015Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-94431","title":"CVE-2026-44944 affecting package iscsi-initiator-utils for versions less than 2.1.12-1","description":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","status":"published","published":"2026-07-29T13:18:46Z","modified":"2026-08-28T17:56:41.335309Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"CLSA-2026-1787316164","title":"iscsi-initiator-utils: Fix of 2 CVEs","description":"- CVE-2026-44943: path traversal via unvalidated IQN in discovery records\n- CVE-2026-44944: iscsiuio control socket authorization bypass","status":"published","published":"2026-08-21T12:42:56Z","modified":"2026-10-26T09:31:29.752989728Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787396809","title":"iscsi-initiator-utils: Fix of 2 CVEs","description":"- CVE-2026-44943: path traversal via unvalidated IQN in discovery records\n- CVE-2026-44944: iscsiuio control socket authorization bypass","status":"published","published":"2026-08-25T07:53:53Z","modified":"2026-10-26T09:30:37.020031967Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:21580-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","status":"published","published":"2026-08-14T06:41:35Z","modified":"2026-08-16T18:23:37.306215387Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23157-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","status":"published","published":"2026-08-14T06:41:21Z","modified":"2026-08-18T18:23:34.986181276Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23223-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","status":"published","published":"2026-08-14T06:41:21Z","modified":"2026-08-27T18:23:09.353399587Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23235-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\nUpdate to version 2.1.12.suse+0.8f77cf16:\n\n- CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create\n  root-owned files outside the database and inject lines into records (bsc#1268353).\n- CVE-2026-44944: incorrect authorization allows unpriviledged local users to use the `isscsiuio` control socket\n  (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Version 2.1.12.suse+0.8f77cf16:\n  * Fix security issues recently discovered by Keith at Linneman Labs.\n  * iscsi-init.service: use `iscsi-gen-initiatorname`.\n  * iscsi-gen-initiatorname: use `@IQN_PREFIX@` as default.\n  * Avoid possible double free of found in `idbm_rec_update_param`.\n  * iscsi: validate interface IP against target address family.\n","status":"published","published":"2026-08-14T06:41:21Z","modified":"2026-08-27T18:23:10.682035823Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3647-1","title":"Security update for open-iscsi","description":"This update for open-iscsi fixes the following issues:\n\n- CVE-2026-44943: remote file-write as root via discovery (bsc#1268353).\n- CVE-2026-44944: iscsiuio control-socket auth bypass (bsc#1268352).\n\nChanges for open-iscsi:\n\n- Update to version 2.1.12.suse+0.8f77cf16:\n * Preparing for version 2.1.12 (#536)\n * iscsi-init.service: Use iscsi-gen-initiatorname\n * iscsi-gen-initiatorname use @IQN_PREFIX@ as default\n * avoid possible double free of found in idbm_rec_update_param (#528)\n * iscsi: validate interface IP against target address family (#527)\n- Update to version 2.1.11.suse+88.8e0635b3:\n * Make iface.example a doc file. (#526)\n * Updated SPEC file to deliver iface.example as a %doc\n file, no longer in the database directory.\n- Update to version 2.1.11.suse+85.4ef97a15:\n * Fix unused variable warning in usr/io.c (#524)\n * Remove old rpm subdirectory, no longer needed.\n * Add tcp.congestion_control configuration option (#520)\n * Small cleanups for firmware discovery. (#522)\n * Fix incorrect parsing of node.discovery_type 'static' and 'fw' (#518)\n * iscsi_net_util: avoid copying NULL pointers with strlcpy() (#515)\n * iscsi: delay reconnect until interface has valid IP. (#511)\n","status":"published","published":"2026-08-19T09:53:51Z","modified":"2026-08-21T09:15:05.803028475Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}