CVE-2026-16791: Lenovo XClarity OneCLI Privilege Escalation

CVE-2026-16791 Overview

CVE-2026-16791 is an insecure temporary file creation vulnerability [CWE-377] in the Linux build of Lenovo XClarity Essentials OneCLI version 5.5.0 and earlier. The flaw lets a local, low-privileged attacker overwrite or truncate arbitrary files with program-generated data when OneCLI runs with elevated privileges. Exploitation depends on user interaction and specific attack prerequisites, which limits practical impact. The issue is tracked in the National Vulnerability Database with a CVSS 4.0 base score of 1.0.

Critical Impact
A local attacker with limited privileges can corrupt or truncate root-owned files when a privileged user executes OneCLI, resulting in integrity and availability loss on affected Linux hosts.

Affected Products

Lenovo XClarity Essentials OneCLI 5.5.0 (Linux)
Lenovo XClarity Essentials OneCLI versions below 5.5.0 (Linux)
Systems where OneCLI is executed with elevated privileges (for example, root)

Discovery Timeline

2026-08-04 - CVE-2026-16791 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16791

Vulnerability Analysis

The vulnerability originates in how the Linux distribution of OneCLI handles temporary files during execution. OneCLI creates or writes to temporary files in a predictable location without safeguards against pre-existing files, symbolic links, or hard links controlled by another local user. When an administrator invokes OneCLI with elevated privileges to perform firmware inventory, configuration, or update tasks, the process writes program-generated data to these paths using the privileges of the invoking user.

A local attacker who can stage a symlink or hard link in the predictable temporary path before OneCLI runs can redirect the privileged write to an arbitrary file on disk. The result is overwrite or truncation of the target file with data OneCLI would have written to the temporary location. The attack does not yield attacker-controlled content in the usual sense, but arbitrary file corruption by root is sufficient to disrupt services, tamper with configuration, or damage audit trails.

Root Cause

The root cause is unsafe temporary file handling as described in CWE-377. OneCLI does not create temporary files exclusively, does not verify that the target path is not a symlink, and does not use a per-invocation randomized directory with restrictive permissions before writing.

Attack Vector

Exploitation requires local access with low privileges, user interaction from a privileged operator, and specific conditions such as winning a timing window or pre-planting a link in the temporary path. Because the attack is local and depends on a privileged user running OneCLI, remote exploitation is not applicable. The EPSS model reflects this constrained profile with a low probability of observed exploitation.

No verified proof-of-concept code has been published. See the Lenovo Support Solution advisory for vendor-provided technical details.

Detection Methods for CVE-2026-16791

Indicators of Compromise

Unexpected symbolic links or hard links present in temporary directories used by OneCLI immediately before a privileged OneCLI run.
Root-owned files, configuration files, or logs that are truncated or contain OneCLI-generated data fragments after a OneCLI invocation.
Local user processes creating files with names matching OneCLI temporary artifacts shortly before OneCLI executes.

Detection Strategies

Audit execve events for OneCli or onecli binaries running with EUID=0 and correlate with open, openat, and linkat events by non-privileged users in the seconds preceding the invocation.
Enable Linux Audit rules on temporary directories to log link creation by non-root users targeting predictable OneCLI file names.
File integrity monitoring on /etc, /var/log, and other sensitive paths to flag truncation or unexpected writes coinciding with OneCLI execution.

Monitoring Recommendations

Forward auditd and execve telemetry from servers running Lenovo management tooling into a centralized analytics platform for correlation across host boundaries.
Track privileged execution of OneCLI as a controlled event and alert when it is invoked outside of change windows.
Baseline the set of local users on management hosts and alert on new interactive local accounts, which reduce the pool of potential attackers for this class of TOCTOU attack.

How to Mitigate CVE-2026-16791

Immediate Actions Required

Upgrade Lenovo XClarity Essentials OneCLI to a version above 5.5.0 on all Linux systems, per the vendor advisory.
Restrict local shell access on servers where OneCLI runs with elevated privileges to a minimal set of trusted administrators.
Avoid invoking OneCLI with sudo or as root on multi-user hosts until patched.

Patch Information

Lenovo provides remediation guidance and fixed versions through the Lenovo Support Solution HT116433 advisory. Apply the vendor-supplied update to the Linux OneCLI package on each affected system and verify the installed version after upgrade.

Workarounds

Run OneCLI from a dedicated administrative account on a host with no untrusted local users.
Set the process umask and TMPDIR to a private, root-owned directory with mode 0700 before executing OneCLI, so temporary artifacts are placed outside world-writable paths.
Enable Linux protections such as fs.protected_symlinks=1 and fs.protected_hardlinks=1 to blunt symlink and hardlink redirection in shared temporary directories.

bash

# Configuration example
sysctl -w fs.protected_symlinks=1
sysctl -w fs.protected_hardlinks=1
mkdir -m 700 /root/onecli-tmp
chown root:root /root/onecli-tmp
TMPDIR=/root/onecli-tmp /opt/lenovo/onecli/OneCli inventory