Critical Security Update for ACL Package: Symlink Traversal Vulnerabilities
Summary
ALSA-2026:43420: Important: acl security update. Affects acl versions < 2.4.0-1.el8_10. Fixed in 2.4.0-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ACL (Access Control Lists) package is essential for managing fine-grained discretionary access rights for files and directories in Unix-like operating systems. It includes utilities such as getfacl and setfacl, which allow users to manipulate access control lists effectively. However, vulnerabilities have been identified in this package that could lead to privilege escalation and unauthorized access.
Vulnerability Detail
The vulnerabilities identified in the ACL package include a symlink traversal privilege escalation via libacl functions (CVE-2026-54369) and a TOCTOU (Time of Check to Time of Use) symlink traversal issue via getfacl/setfacl (CVE-2026-54370). These vulnerabilities could allow an attacker to exploit the ACL utilities to gain unauthorized access to files or escalate their privileges, potentially compromising the security of the system.
How To Fix
Minimum fixed version
2.4.0-1.el8_10
This is the first release that contains the fix.
sudo dnf update aclTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected utilities (getfacl and setfacl) until the package is updated. This can be done by changing the permissions of these utilities using the command: 'sudo chmod 700 /usr/bin/getfacl /usr/bin/setfacl'. However, this may limit legitimate access for users who need these tools.
Conclusion
In summary, the ACL package has critical vulnerabilities that could lead to privilege escalation and unauthorized access. It is essential to update to the patched version to mitigate these risks. Additionally, using tools like Vulert can help monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for acl →
FAQ
Failure to address this vulnerability could lead to unauthorized access to sensitive files and potential privilege escalation, compromising the security of the entire system.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
Yes, you can set up a cron job to regularly check for updates and apply them automatically, ensuring that your system remains secure.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file. You can check your application for vulnerabilities in real-time without needing to install any software.
For more details about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for acl.
