CVE-2026-109971
Description
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Statement
The PKCS#11 clevis pin is an opt-in feature requiring explicit configuration (clevis luks bind pkcs11), PKCS#11 hardware, and activation of the corresponding systemd service or dracut module. Default clevis installations are not affected.
Red Hat rates this Moderate because the pkcs11-tool process is short-lived and the attacker must catch it during execution. The exposed credential is the PKCS#11 token PIN, not the LUKS passphrase directly, and exploiting the PIN additionally requires physical access to the PKCS#11 token.
Mitigation
No end-user mitigation is available for this issue. The PIN exposure occurs in the clevis-decrypt-pkcs11 script itself, which must be updated to pass the PIN through an environment variable instead of the command line.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 4.7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.
Acknowledgements
This issue was discovered by Sergio Correia (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
