CVE-2026-4105

MEDIUM

6.7

Description

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

CVE Details

CVSS v3.1 Score6.7

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityHIGH

Privileges RequiredLOW

User InteractionREQUIRED

Published3/13/2026

Last Modified3/16/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-284

References

https://access.redhat.com/security/cve/CVE-2026-4105(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2447262(secalert@redhat.com)

https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862(secalert@redhat.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.