Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-41054: Debian OpenSSL Installation Error Allows Man-in-the-Middle Attacks
CVE-2026-41054 · published 5 months ago
Summary
An error in Debian's OpenSSL installation process allows attackers to intercept sensitive information. This affects systems running Debian's OpenSSL package. To mitigate this issue, update your Debian system to the latest version and ensure OpenSSL is properly configured.
What to do
- Update bellsoft haveged to version 1.9.21-r0.
- Update debian haveged to version 1.9.14-1+deb12u1.
- Update debian haveged to version 1.9.19-12+deb13u1.
- Update debian haveged to version 1.9.21-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | haveged | All versions |
| Debian:12 | debian | haveged |
< 1.9.14-1+deb12u1 Fix: upgrade to 1.9.14-1+deb12u1
|
| Debian:13 | debian | haveged |
< 1.9.19-12+deb13u1 Fix: upgrade to 1.9.19-12+deb13u1
|
| Debian:14 | debian | haveged |
< 1.9.21-1 Fix: upgrade to 1.9.21-1
|
| Alpaquita:25 | bellsoft | haveged |
>= 1.9.19-r0, < 1.9.21-r0 Fix: upgrade to 1.9.21-r0
|
| Alpaquita:stream | bellsoft | haveged |
>= 1.9.18-r0, < 1.9.21-r0 Fix: upgrade to 1.9.21-r0
|
| Ubuntu:22.04:LTS | canonical | haveged | All versions |
| Ubuntu:24.04:LTS | canonical | haveged | All versions |
| Ubuntu:25.10 | canonical | haveged | All versions |
| Ubuntu:26.04:LTS | canonical | haveged | All versions |
Original advisory text
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root ...
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
References
- https://security-tracker.debian.org/tracker/CVE-2026-41054 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/05/19/4
- https://docs.bell-sw.com/security/cves/CVE-2026-41054 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41054 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/19/3 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1264086 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-41054 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/20/1
- http://www.openwall.com/lists/oss-security/2026/05/19/5
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-41054
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-305Authentication Bypass by Primary Weakness
Timeline
Published20 May 2026
Updated3 Nov 2026
First seen19 May 2026
Sources
UBUNTU-CVE-2026-41054 · OSV
DEBIAN-CVE-2026-41054 · OSV
CVE-2026-41054 · NVD
BELL-CVE-2026-41054 · OSV
Track software like this
Free during beta