Privilege Escalation Vulnerability in OpenCryptoki Package
Summary
RLSA-2026:4717: Moderate: opencryptoki security update. Affects opencryptoki versions < 0:3.25.0-5.el10_1.2. Fixed in 0:3.25.0-5.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCryptoki is a software implementation of the PKCS#11 API, designed for use with IBM Cryptocards, including models like IBM 4764 and 4765. It supports various cryptographic hardware and provides a software token implementation for environments without hardware. The package includes essential components such as the Slot Daemon (pkcsslotd) and utilities for managing cryptographic operations.
Vulnerability Detail
The vulnerability identified as CVE-2026-23893 allows for privilege escalation or data exposure through symlink following. This issue arises from improper handling of symbolic links, which could enable an attacker to manipulate file access permissions, potentially leading to unauthorized access to sensitive data or system resources. The CVSS score for this vulnerability is 6.8, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:3.25.0-5.el10_1.2
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected components and monitor file permissions closely until the package is updated. Additionally, avoid using symlinks in critical areas of the application until the vulnerability is resolved.
Conclusion
The OpenCryptoki package has a moderate vulnerability (CVE-2026-23893) that could lead to privilege escalation or data exposure. It is crucial to update the package to the latest version to mitigate risks and ensure system security. Utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for opencryptoki →
FAQ
CVE-2026-23893 is a vulnerability in the OpenCryptoki package that allows for privilege escalation or data exposure via symlink following.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.8, indicating a moderate risk level.
Update the OpenCryptoki package to the patched version 0:3.25.0-5.el10_1.2 and restrict access to sensitive components as a temporary measure.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
