Critical Security Update for Yggdrasil: Addressing Root and TLS Vulnerabilities
Summary
ALSA-2026:17075: Important: yggdrasil security update. Affects yggdrasil versions < 0.4.8-5.el10_1. Fixed in 0.4.8-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to various child 'worker' processes. It communicates with these worker processes through a D-Bus message broker, making it essential for applications that rely on efficient data handling and messaging. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing Yggdrasil.
Vulnerability Detail
The vulnerabilities stem from two main issues: First, the golang internal syscall allows Root.Chmod to follow symlinks out of the root directory, potentially leading to unauthorized file permissions (CVE-2026-32282). Second, a Denial of Service vulnerability exists in the Go crypto/tls package, where multiple TLS 1.3 key update messages can overwhelm the system, causing service disruptions (CVE-2026-32283). These vulnerabilities can lead to unauthorized access and service outages, posing significant risks to system integrity and availability.
How To Fix
Minimum fixed version
0.4.8-5.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected services and monitoring for unusual activity until the update can be applied. Additionally, review and restrict file permissions to mitigate the risk of unauthorized access.
Conclusion
In summary, the identified vulnerabilities in Yggdrasil pose significant risks that can lead to unauthorized access and service disruptions. It is crucial to update to the patched version as soon as possible to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for yggdrasil →
FAQ
Yggdrasil is a system daemon that routes data from an MQTT broker to worker processes, facilitating efficient data handling.
The vulnerabilities include unauthorized symlink access and a Denial of Service risk due to multiple TLS 1.3 key updates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, restrict access to the affected services and monitor for any unusual activity as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
