CVE-2026-3184: util-linux Auth Bypass Vulnerability

CVE-2026-3184 Overview

A flaw was found in util-linux. Improper hostname canonicalization in the login(1) utility, when invoked with the -h option, can modify the supplied remote hostname before setting PAM_RHOST. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

Critical Impact

This vulnerability allows attackers to bypass PAM-based host access controls by exploiting improper hostname validation, potentially enabling unauthorized access to protected systems.

Affected Products

• util-linux (affected versions not specified)

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-3184 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-3184

Vulnerability Analysis

This vulnerability (CWE-289: Authentication Bypass by Alternate Name) stems from improper hostname canonicalization in the util-linux login(1) utility. When an administrator configures PAM modules to restrict access based on hostnames (typically using pam_access or similar modules), the system expects to receive the authentic fully qualified domain name (FQDN) of the connecting host.

However, when login is invoked with the -h option to specify a remote hostname, the utility performs canonicalization operations that can alter the hostname before it is passed to PAM via the PAM_RHOST item. This creates a mismatch between what PAM expects and what it receives, allowing an attacker to craft hostnames that bypass access control lists while still appearing legitimate.

The attack requires specific network conditions and relies on the target system using hostname-based PAM access controls, which limits the attack surface. However, in environments where such controls are the primary authentication mechanism, this vulnerability could enable complete bypass of host-based restrictions.

Root Cause

The root cause lies in the hostname processing logic within the login(1) utility. When processing the -h flag argument, the utility performs canonicalization that may truncate, modify, or otherwise transform the provided hostname. This transformation occurs before the hostname is set as PAM_RHOST, meaning PAM modules receive an altered version of the original hostname. If PAM access rules are configured to allow or deny specific FQDNs, an attacker can craft input that canonicalizes to an allowed hostname while originating from a different source.

Attack Vector

The attack vector is network-based with high complexity requirements. An attacker must:

1. Identify a target system using hostname-based PAM access controls
2. Determine the allowed hostnames in the PAM configuration
3. Craft a specially formatted hostname that will canonicalize to match an allowed entry
4. Connect to the target system through a service that invokes login -h with attacker-controlled hostname data

The vulnerability exploits the mismatch between the attacker-supplied hostname and the canonicalized version that PAM evaluates. For example, services like telnetd or rlogind that use login -h to record remote hostnames could be potential attack surfaces. The attacker provides a crafted hostname string that, after canonicalization, matches an entry in the PAM access control list, thereby gaining unauthorized access.

Detection Methods for CVE-2026-3184

Indicators of Compromise

• Login attempts with unusually formatted or malformed hostnames in authentication logs
• Discrepancies between DNS-resolved hostnames and PAM_RHOST values recorded in logs
• Successful authentications from hosts that should be blocked by PAM access rules
• Authentication entries with truncated or altered hostname strings compared to source IP reverse DNS

Detection Strategies

• Monitor /var/log/secure and /var/log/auth.log for login events with suspicious hostname patterns
• Implement correlation rules to compare PAM_RHOST values against known allowed hostnames and reverse DNS lookups
• Configure PAM auditing to log detailed authentication context including raw and processed hostname values
• Deploy network intrusion detection rules to identify crafted hostname patterns in authentication protocols

Monitoring Recommendations

• Enable verbose PAM logging to capture full authentication context including hostname processing
• Configure SIEM rules to alert on hostname mismatches between expected and actual values
• Implement baseline monitoring for remote login patterns to detect anomalous access sources
• Review PAM access control configurations to identify rules that rely solely on hostname-based restrictions

How to Mitigate CVE-2026-3184

Immediate Actions Required

• Review PAM configurations for modules using hostname-based access controls (pam_access, etc.)
• Consider supplementing hostname-based restrictions with IP-based controls where possible
• Enable enhanced logging for authentication events to detect potential exploitation attempts
• Restrict or disable remote login services that invoke login -h until patches are applied

Patch Information

Security updates are expected from util-linux maintainers and downstream Linux distributions. Organizations should monitor the Red Hat CVE-2026-3184 Advisory and Red Hat Bug Report #2442570 for patch availability and apply updates as soon as they become available through official distribution channels.

Workarounds

• Migrate from hostname-based PAM access controls to IP-based restrictions where feasible
• Implement additional authentication layers (multi-factor authentication) that do not rely on hostname validation
• Use firewall rules at the network level to enforce host restrictions independently of PAM
• Consider disabling the -h option processing in login if not required in your environment

# Example: Supplement hostname-based PAM rules with IP restrictions in /etc/security/access.conf
# Instead of relying solely on hostnames:
# + : admin : trusted.example.com
# Use IP-based restrictions:
+ : admin : 192.168.1.0/24
- : ALL : ALL