CVE-2026-58015

Name of the Vulnerable Software and Affected Versions GLib (affected versions not specified)

Description A flaw exists in the D-Bus client-side implementation of the DBUS COOKIE SHA1 SASL authentication mechanism. The system fails to validate the cookie context parameter received from the server. A malicious D-Bus server can provide a cookie context containing path traversal sequences—a technique used to access files and directories outside the intended folder—forcing the client to read arbitrary files. This allows the server to exfiltrate sensitive data by comparing guessed file contents against a generated hash. The issue involves the keyring lookup entry() and mechanism client data receive() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.