Moderate Vulnerability in firewalld Package: Local User Can Modify Firewall State
Summary
ALSA-2026:67585: Moderate: firewalld security update. Affects firewall-applet versions < 1.3.4-20.el9_8. Fixed in 1.3.4-20.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
firewalld is a dynamic firewall service daemon that provides a customizable firewall with a D-Bus interface. It allows users to manage firewall rules dynamically without the need to restart the service. The package is integral for maintaining network security on systems running AlmaLinux, ensuring that only authorized traffic is allowed through the firewall.
Vulnerability Detail
The vulnerability identified as CVE-2026-4948 allows a local unprivileged user to modify the firewall state due to a mis-authorization in the D-Bus setter. This flaw can lead to unauthorized changes in firewall configurations, potentially exposing the system to security risks by allowing unwanted traffic or blocking legitimate traffic.
How To Fix
Minimum fixed version
1.3.4-20.el9_8
This is the first release that contains the fix.
sudo dnf update firewall-appletTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the D-Bus interface for firewalld to prevent unauthorized users from making changes. This can be done by modifying the D-Bus configuration files, but it is recommended to apply the patch as soon as possible for a permanent fix.
Conclusion
The firewalld vulnerability identified as CVE-2026-4948 poses a moderate risk by allowing local unprivileged users to alter firewall states. It is crucial to update the affected packages to the patched version to mitigate this risk. For those unable to update immediately, implementing a temporary workaround is advisable.
See every vulnerability recorded for firewall-applet →
FAQ
CVE-2026-4948 is a vulnerability in the firewalld package that allows local unprivileged users to modify the firewall state due to a D-Bus setter mis-authorization.
You can check if your system is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to use the Vulert playground without signup.
The risks include unauthorized modifications to firewall rules, which can lead to exposure of sensitive data or disruption of services by allowing unwanted traffic.
Yes, a patch is available in version 1.3.4-20.el9_8 for the affected packages. It is recommended to update to this version immediately.
If you cannot update immediately, consider restricting access to the D-Bus interface for firewalld as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for firewall-applet.
