CVE-2026-59674
Description
A flaw was found in suricata. This vulnerability, related to improper handling of symbolic links, allows a local suricata user to escalate their privileges to root. By exploiting this, an attacker could gain full control over the affected system.
Statement
This issue is specific to the Suricata packaging shipped by openSUSE Tumbleweed: an unsafe recursive chown in the package's %post scriptlet follows symbolic links, allowing the local suricata user to escalate privileges to root during a package reinstall/upgrade. Red Hat's Suricata packages, built and maintained independently through Fedora and EPEL, do not contain this vulnerable packaging script and are not affected by this specific CVE.
Mitigation
No mitigation is necessary for Red Hat's Suricata packages, as they do not contain the vulnerable packaging script described in this CVE. Refer to the upstream openSUSE advisory for guidance on affected openSUSE Tumbleweed systems (fixed in suricata 8.0.5-2.1).
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
