Critical Security Flaws in Yggdrasil: Addressing CVE-2026-32282 and CVE-2026-32283
Summary
RLSA-2026:17075: Important: yggdrasil security update. Affects yggdrasil versions < 0:0.4.8-5.el10_1. Fixed in 0:0.4.8-5.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yggdrasil is a system daemon designed to subscribe to topics on an MQTT broker, facilitating the routing of data to appropriate child worker processes. It employs a D-Bus message broker for data exchange, making it integral for applications relying on real-time data communication. However, recent vulnerabilities have been identified that could compromise its security.
Vulnerability Detail
The vulnerabilities stem from two significant issues: CVE-2026-32282, where Root.Chmod can follow symlinks out of the root, potentially allowing unauthorized access to sensitive files, and CVE-2026-32283, which enables a Denial of Service attack through multiple TLS 1.3 key update messages. These vulnerabilities can lead to severe security breaches, including unauthorized data access and service disruptions.
How To Fix
Minimum fixed version
0:0.4.8-5.el10_1
This is the first release that contains the fix.
sudo dnf update yggdrasilTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the Yggdrasil daemon and monitoring for unusual activity. Additionally, you can disable TLS 1.3 key updates until the patch is applied, although this may affect performance and security.
Conclusion
The identified vulnerabilities in Yggdrasil pose significant risks that require immediate attention. By updating to the latest patched version and implementing recommended workarounds, users can mitigate potential threats and ensure the security of their applications.
See every vulnerability recorded for yggdrasil →
FAQ
The main vulnerabilities are CVE-2026-32282, which allows Root.Chmod to follow symlinks out of the root, and CVE-2026-32283, which can lead to Denial of Service via multiple TLS 1.3 key update messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for these vulnerabilities is 7.8, indicating a high level of severity.
If immediate updates are not possible, implement access restrictions and monitor for unusual activity as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for yggdrasil.
