Privilege Escalation Vulnerability in attr Package: Symlink Traversal Issue
Summary
RLSA-2026:60226: Moderate: attr security update. Affects attr versions < 0:2.6.0-1.el9_8. Fixed in 0:2.6.0-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The attr package is designed to manage extended attributes in Linux systems, allowing users to store metadata such as access control lists and capabilities for files and directories. This functionality is crucial for enhancing security and managing permissions effectively. However, the package has been found to have a vulnerability that could allow unauthorized users to escalate their privileges through symlink traversal.
Vulnerability Detail
The vulnerability identified as CVE-2026-54371 in the attr package allows for a symlink traversal privilege escalation. This occurs when the getfattr and setfattr commands are exploited by an attacker to manipulate file attributes in a way that bypasses standard access controls. The potential ramifications include unauthorized access to sensitive data and the ability to execute commands with elevated privileges, posing a significant security risk to affected systems.
How To Fix
Minimum fixed version
0:2.6.0-1.el9_8
This is the first release that contains the fix.
sudo dnf update attrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the getfattr and setfattr commands to trusted users only, thereby minimizing the risk of exploitation until the package can be updated.
Conclusion
The attr package has a moderate vulnerability (CVE-2026-54371) that allows for privilege escalation through symlink traversal. It is crucial for users to update to the latest patched version to mitigate this risk. Temporary workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for attr →
FAQ
CVE-2026-54371 is a vulnerability in the attr package that allows for privilege escalation through symlink traversal.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to gain elevated privileges, potentially leading to unauthorized access to sensitive data.
Yes, a patched version of the attr package is available. Updating to version 0:2.6.0-1.el9_8 or later will resolve the issue.
If an immediate update is not possible, restrict access to the getfattr and setfattr commands to trusted users as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for attr.
