Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-4948: firewalld lets unprivileged user change firewall settings
CVE-2026-4948 · published 7 months ago
Summary
On systems using firewalld (including Debian and Red Hat Enterprise Linux 7, 8, 9, and 10), a regular local user can alter the active firewall configuration without proper permission. This could let someone unintentionally or maliciously open or close network ports, affecting the security of the server. Apply the latest updates from your distribution or restrict local user access to firewalld to mitigate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | firewalld | All versions |
| Debian:12 | debian | firewalld | All versions |
| Debian:13 | debian | firewalld | All versions |
| Debian:14 | debian | firewalld | All versions |
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat openshift container platform 4 | All versions |
| – | firewalld | firewalld |
<= 2.4.0 cpe:2.3:a:firewalld:firewalld:*:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
7.0 cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| – | red hat | red hat enterprise linux 10.0 extended update support | All versions |
| – | red hat | red hat enterprise linux 9.6 extended update support | All versions |
| Ubuntu:16.04:LTS | canonical | firewalld | All versions |
Original advisory text
Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.
References
- https://security-tracker.debian.org/tracker/CVE-2026-4948 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2026/05/msg00029.html
- https://access.redhat.com/security/cve/CVE-2026-4948 Mitigation Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2452086 Issue Tracking Vendor Advisory
- https://access.redhat.com/errata/RHBA-2026:28238
- https://access.redhat.com/errata/RHSA-2026:67585
- https://access.redhat.com/errata/RHSA-2026:67843
- https://ubuntu.com/security/CVE-2026-4948 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-4948 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:76844
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-279Incorrect Execution-Assigned Permissions
Timeline
Published27 Mar 2026
Updated26 Oct 2026
First seen27 Mar 2026
Sources
CVE-2026-4948 · NVD
CVE-2026-4948 · MITRE
DEBIAN-CVE-2026-4948 · OSV
UBUNTU-CVE-2026-4948 · OSV
Track software like this
Free during beta