CVE-2026-14460: Pardus-Software Auth Bypass Vulnerability

CVE-2026-14460 Overview

CVE-2026-14460 is a Missing Authorization vulnerability [CWE-862] in the pardus-software package developed by TUBITAK BILGEM Software Technologies Research Institute. The flaw allows a local authenticated attacker to perform argument injection against the software management component. Successful exploitation crosses a security boundary, yielding high impact to confidentiality, integrity, and availability of the affected system. The issue affects pardus-software versions from <= 1.0.4 and is fixed in version 1.0.5.

Critical Impact
A local low-privileged user can inject arguments into a privileged operation, escalate privileges, and fully compromise the host running vulnerable pardus-software builds.

Affected Products

TUBITAK BILGEM pardus-software versions <= 1.0.4
Pardus Linux desktop systems shipping vulnerable pardus-software builds
Fixed in pardus-software version 1.0.5

Discovery Timeline

2026-07-03 - CVE-2026-14460 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14460

Vulnerability Analysis

The vulnerability stems from a Missing Authorization weakness in the pardus-software component, which manages software installation and package operations on Pardus Linux. The component exposes a privileged interface without verifying that the caller is authorized to supply the parameters it processes. An unprivileged local user can pass crafted arguments that the component forwards to an underlying privileged process. Because the input reaches the privileged process without proper access control checks, the attacker achieves argument injection into an operation running at higher trust. The scope change reflected in the vulnerability data confirms that the exploited component and the impacted component are different, indicating cross-boundary privilege compromise.

Root Cause

The root cause is the absence of an authorization check between the user-facing interface of pardus-software and the privileged backend that performs package management actions. The component trusts the invoking user to supply safe arguments rather than gating the call path with policy enforcement. This maps directly to [CWE-862] Missing Authorization.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. An authenticated attacker with a shell session or desktop access invokes the vulnerable interface and injects additional arguments into the privileged operation. The injected arguments alter the behavior of the downstream process, allowing the attacker to execute actions or read and modify data outside the reach of their normal account. The vulnerability description does not include public exploit code, and no entries exist in ExploitDB or CISA KEV at time of publication.

Detection Methods for CVE-2026-14460

Indicators of Compromise

Unexpected invocations of pardus-software binaries or D-Bus methods by non-administrative users
Package management operations (apt, dpkg) launched as root with unusual argument patterns originating from pardus-software
New packages installed, removed, or held that do not correlate with authorized administrative activity
Modifications to /etc/apt/sources.list.d/ or repository trust stores initiated via pardus-software sessions

Detection Strategies

Audit process ancestry for privileged package operations spawned by pardus-software and correlate them with the invoking user identity
Enable Linux audit rules (auditd) on the pardus-software executables and any Polkit or D-Bus actions they expose
Alert on command lines containing shell metacharacters or unexpected flags passed to apt or dpkg from GUI-invoked helpers

Monitoring Recommendations

Forward auditd, journalctl, and Polkit authorization logs to a central log store for correlation across hosts
Baseline normal pardus-software argument patterns and alert on deviations, especially long or encoded argument strings
Track package inventory changes on Pardus endpoints and reconcile against approved change tickets

How to Mitigate CVE-2026-14460

Immediate Actions Required

Upgrade pardus-software to version 1.0.5 or later on all Pardus Linux systems
Inventory endpoints running Pardus distributions and confirm the installed pardus-software version with dpkg -l pardus-software
Restrict interactive local access on shared or multi-user Pardus hosts until patching completes
Review the Siber Güvenlik Notification TR-26-0497 advisory for vendor guidance

Patch Information

The vendor addressed CVE-2026-14460 in pardus-software version 1.0.5. Apply the update through the standard Pardus repositories. Confirm the fix by verifying that the installed version is 1.0.5 or newer after the upgrade completes.

Workarounds

Remove or disable the pardus-software package on systems where GUI-driven software management is not required
Tighten Polkit policy files to require administrator authentication for package management actions invoked by desktop users
Limit local logon rights on servers or kiosks to trusted administrators until the patched version is deployed

bash

# Verify installed version and upgrade pardus-software
dpkg -l pardus-software | awk '/pardus-software/ {print $2, $3}'
sudo apt update
sudo apt install --only-upgrade pardus-software
dpkg -l pardus-software | awk '/pardus-software/ {print $2, $3}'