CVE-2026-58015: Gnome Glib Path Traversal Vulnerability

CVE-2026-58015 Overview

CVE-2026-58015 is a path traversal vulnerability in GLib's D-Bus client-side implementation of the DBUS_COOKIE_SHA1 Simple Authentication and Security Layer (SASL) mechanism. The client fails to validate the cookie_context parameter supplied by the server. A malicious D-Bus server can send a cookie_context containing path traversal sequences, forcing the client to read arbitrary files on the system. The attacker then exfiltrates sensitive data by verifying guessed file contents against the resulting hash. The flaw affects GNOME GLib and multiple Red Hat Enterprise Linux versions [CWE-22].

Critical Impact
A remote malicious D-Bus server can read arbitrary files accessible to the D-Bus client process and exfiltrate their contents through a hash-oracle attack.

Affected Products

GNOME GLib (all versions prior to fix)
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Applications and services linking against vulnerable GLib GIO D-Bus client libraries

Discovery Timeline

2026-06-30 - CVE-2026-58015 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in the NVD database

Technical Details for CVE-2026-58015

Vulnerability Analysis

The DBUS_COOKIE_SHA1 SASL mechanism authenticates D-Bus clients by proving knowledge of a shared secret stored in a cookie file. During authentication, the server transmits a cookie_context identifier that the client uses to locate the corresponding cookie file within the user's ~/.dbus-keyrings/ directory.

GLib's client-side implementation accepts the server-supplied cookie_context without sanitizing it against directory traversal sequences. An attacker controlling a D-Bus server endpoint can supply a cookie_context value containing ../ sequences or absolute path components. The client then opens and reads the referenced file, treating its contents as cookie material for the challenge-response hash.

Because the client returns a SHA-1 hash computed over server-controlled challenge data concatenated with the file contents, the attacker can iteratively guess file contents offline and confirm matches against the returned hash. This converts an arbitrary file read into practical data exfiltration.

Root Cause

The root cause is missing input validation on the cookie_context parameter in the D-Bus SASL client state machine. The parameter is treated as a trusted filename component and concatenated directly into a filesystem path without checks for .., /, or null bytes, matching the definition of CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires the victim client to initiate a D-Bus connection to an attacker-controlled server, for example through a malicious peer-to-peer D-Bus endpoint, a compromised system service, or a rogue socket path. No user interaction beyond the connection attempt is required, and no prior authentication is needed. The attacker then supplies a crafted cookie_context during the SASL handshake and performs the hash-oracle guessing to reconstruct file contents such as SSH keys, tokens, or configuration secrets accessible to the client process.

See the GNOME GitLab Issue #3931 and the Red Hat CVE-2026-58015 Advisory for the upstream technical discussion.

Detection Methods for CVE-2026-58015

Indicators of Compromise

D-Bus SASL authentication exchanges where the cookie_context field contains ../, absolute paths, or non-alphanumeric characters outside the expected identifier set.
Unexpected file reads from the D-Bus client process targeting files outside ~/.dbus-keyrings/, such as /etc/shadow, SSH private keys, or application secrets.
Outbound D-Bus connections from workstations or servers to untrusted socket paths or TCP endpoints.

Detection Strategies

Inspect D-Bus traffic on peer-to-peer sockets for malformed DBUS_COOKIE_SHA1 handshake data, focusing on non-conforming cookie_context values.
Enable audit rules (auditd) on Linux hosts to log openat and open syscalls issued by processes linked against libgio-2.0 when accessing paths outside expected keyring directories.
Correlate GLib version inventory data against patched releases to identify hosts still exposing the vulnerable code path.

Monitoring Recommendations

Monitor process telemetry for D-Bus client applications establishing sessions with non-standard bus addresses, especially over TCP.
Alert on file-access anomalies where GLib-based applications read sensitive files they do not normally touch.
Track vendor advisories from Red Hat and GNOME for updated glib2 package versions and roll detection content forward as fixes land.

How to Mitigate CVE-2026-58015

Immediate Actions Required

Apply vendor-supplied glib2 updates as soon as they are published by your Linux distribution. Track the Red Hat CVE-2026-58015 Advisory for RHEL 6 through 10 errata.
Inventory all systems and containers using GLib and prioritize patching hosts that initiate D-Bus connections to remote or untrusted endpoints.
Restrict D-Bus clients so they only connect to trusted local bus sockets and disallow arbitrary TCP D-Bus addresses.

Patch Information

The fix is tracked upstream in GNOME GitLab Issue #3931. Red Hat tracks distribution packaging in Red Hat Bug Report #2492256. Install the patched glib2 package for your distribution, then restart D-Bus-dependent services or reboot to ensure all processes load the fixed library.

Workarounds

Avoid initiating D-Bus client connections to untrusted servers, including remote TCP bus addresses and unknown Unix sockets.
Where feasible, disable the DBUS_COOKIE_SHA1 mechanism and rely on EXTERNAL authentication over local Unix sockets, which uses kernel-verified credentials instead of file-based cookies.
Apply mandatory access controls such as SELinux or AppArmor policies to limit which files D-Bus client processes can read.

bash

# Configuration example: update glib2 on Red Hat Enterprise Linux
sudo dnf clean all
sudo dnf update glib2 glib2-devel

# Verify installed version against the vendor advisory
rpm -q glib2

# Restart D-Bus and dependent services (or reboot)
sudo systemctl restart dbus