Medium severity5.5NVD Advisory· Published Mar 27, 2026· Updated May 15, 2026

CVE-2026-4948

Description

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Firewalld/Firewalld2 versions
cpe:2.3:a:firewalld:firewalld:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:firewalld:firewalld:*:*:*:*:*:*:*:*range: <=2.4.0
- (no CPE)
Red Hat/Enterprise Linux Server
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
osv-coords2 versions
pkg:rpm/suse/firewalld&distro=SUSE%20Linux%20Micro%206.1 pkg:rpm/suse/rpcbind&distro=SUSE%20Linux%20Micro%206.0
< 2.0.0-slfo.1.1_2.1+ 1 more
- (no CPE)range: < 2.0.0-slfo.1.1_2.1
- (no CPE)range: < 1.2.9-1.1

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-4948nvdMitigationVendor Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2026/05/msg00029.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000