CVE-2026-44943: open-iscsi Path Traversal Vulnerability

CVE-2026-44943 Overview

CVE-2026-44943 is a path traversal vulnerability [CWE-22] in open-iscsi, the Linux iSCSI initiator used to connect hosts to iSCSI storage targets. A remote attacker positioned as a man-in-the-middle (MITM) can abuse improper pathname validation to create root-owned files outside the intended database directory and inject arbitrary lines into iSCSI records. The flaw affects open-iscsi up to and including commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e, which contains the fix.

Critical Impact
A network-positioned MITM attacker can write root-owned files to arbitrary filesystem locations and inject lines into iSCSI records, undermining storage integrity on affected Linux hosts.

Affected Products

open-iscsi project (upstream) through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
Linux distributions packaging vulnerable open-iscsi builds (tracked in SUSE Bugzilla)
iscsiuio and iscsid components handling iSNS discovery and IPC

Discovery Timeline

2026-07-29 - CVE-2026-44943 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-44943

Vulnerability Analysis

The vulnerability resides in how open-iscsi processes data received from remote iSNS (Internet Storage Name Service) discovery responses and IPC clients. Untrusted input reaches filesystem operations without adequate validation of pathname components. An attacker who can intercept or spoof iSNS discovery traffic can supply crafted values that escape the intended database directory and cause iscsid, running as root, to create files at attacker-chosen paths. The same input path allows injection of additional lines into iSCSI configuration records.

Root Cause

Two defects contribute to the issue. First, in iscsiuio/src/unix/iscsid_ipc.c, the IPC access check called mgmt_peeruser() against the wrong file descriptor (iscsid_opts.fd instead of the accepted socket s2), letting non-root callers pass the administrative check. Second, in usr/discovery.c, iSNS discovery ran with isns_config.ic_security = 0, disabling authentication and allowing MITM attackers to supply crafted discovery records that drive path traversal writes.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker in the network path between the initiator and an iSNS server, or an attacker able to reach the local IPC socket, sends crafted responses or messages containing traversal sequences in target or portal name fields. iscsid then writes root-owned files outside the intended nodes/send_targets database and appends attacker-controlled lines into records used on subsequent iSCSI logins.

// Patch excerpt: iscsiuio/src/unix/iscsid_ipc.c
// Fix: check peer credentials on the accepted socket, and
// continue the accept loop instead of breaking on rejection.
-		if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) {
+		if (!mgmt_peeruser(s2, user) || strncmp(user, "root", PEERUSER_MAX)) {
 			close(s2);
 			ILOG_ERR(PFX "Access error: non-administrative connection rejected");
-			break;
+			continue;
 		}

Source: GitHub Commit for open-iscsi Fix

// Patch excerpt: usr/discovery.c
// iSNS discovery path where ic_security is initialized to 0,
// leaving discovery traffic unauthenticated and MITM-exposed.
 	uint32_t status;
 	int rc;
+
 	isns_config.ic_security = 0;
+
 	source = isns_source_create_iscsi(iname);
 	if (!source)
 		return ISCSI_ERR_NOMEM;

Source: GitHub Commit for open-iscsi Fix

Detection Methods for CVE-2026-44943

Indicators of Compromise

Unexpected root-owned files appearing outside /etc/iscsi/nodes/ and /etc/iscsi/send_targets/, particularly with pathnames containing .. traversal fragments.
Modified or extended lines in existing iSCSI node records (for example, unexpected node.session.* or node.conn[0].* entries) that were not written by an administrator.
iscsid log entries referencing iSNS discovery from unexpected servers or portals.

Detection Strategies

Compare the on-disk open-iscsi database against a known-good baseline and flag any files whose path resolves outside the database root.
Monitor process telemetry for iscsid and iscsiuio performing open()/write() syscalls on paths outside their expected directories.
Inspect network traffic for iSNS (TCP/UDP 3205) sessions that lack authentication headers or originate from non-approved iSNS servers.

Monitoring Recommendations

Enable file integrity monitoring on /etc/iscsi/ and alert on writes by iscsid to paths outside that tree.
Log and centrally review iscsid/iscsiuio syslog output, including access-rejection messages emitted by the patched IPC check.
Track package versions of open-iscsi across the Linux fleet and alert on hosts still running builds prior to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

How to Mitigate CVE-2026-44943

Immediate Actions Required

Upgrade open-iscsi to a build that includes commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e or the equivalent distribution patch.
Restrict iSNS discovery to trusted, authenticated servers reachable only over management networks.
Audit /etc/iscsi/ for unauthorized files or injected record lines and restore from a known-good backup where needed.

Patch Information

The upstream fix is available in the open-iscsi repository as commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. It corrects the IPC peer credential check in iscsiuio/src/unix/iscsid_ipc.c and adjusts iSNS discovery handling in usr/discovery.c. Distribution tracking is available via the SUSE Bugzilla CVE-2026-44943 entry, and the code changes are documented in the GitHub Commit for open-iscsi Fix.

Workarounds

Disable iSNS-based discovery and use static or SendTargets discovery against explicitly trusted portals until the patch is deployed.
Segment iSCSI initiator and target traffic onto a dedicated storage VLAN that MITM attackers cannot reach.
Enforce strict filesystem permissions on /etc/iscsi/ and monitor for unauthorized writes by the iscsid process.

bash

# Verify installed open-iscsi version and confirm the fix commit is present
rpm -q open-iscsi      # RPM-based distributions
dpkg -s open-iscsi     # Debian/Ubuntu

# Disable iSNS discovery in iscsid.conf until patched
sudo sed -i 's/^isns.address.*/#&/' /etc/iscsi/iscsid.conf
sudo systemctl restart iscsid