CVE-2026-59680 Overview
CVE-2026-59680 is an operating system command injection vulnerability in yast2-users, the YaST module used to manage local and directory-based user accounts on SUSE and openSUSE systems. The flaw resides in the get_password_term() function in src/include/users/dialogs.rb, which reads the shadowLastChange and shadowExpire LDAP attributes without numeric validation. The unsanitized values are passed to format_days_after_epoch(), which interpolates them into a shell command executed through Ruby backticks. An administrator who views or edits the Password Settings tab of a malicious LDAP user entry triggers root command execution on the host running yast2 users.
Critical Impact
Attackers who control attribute values in a federated or external LDAP directory can execute arbitrary commands as root on any SUSE host whose administrator opens the affected user's Password Settings tab.
Affected Products
- yast2-users through version 5.0.8
- SUSE Linux Enterprise distributions shipping the affected yast2-users package
- openSUSE distributions shipping the affected yast2-users package
Discovery Timeline
- 2026-09-01 - CVE-2026-59680 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-59680
Vulnerability Analysis
The vulnerability is an OS command injection classified under [CWE-78]. The yast2-users module supports management of user accounts stored in external or federated Lightweight Directory Access Protocol (LDAP) directories. When an administrator opens the Password Settings tab for a user, get_password_term() retrieves shadow-related attributes and hands them to a formatting helper.
Both shadowLastChange and shadowExpire are read using GetString(), which returns the raw attribute value with no type checking. The helper format_days_after_epoch() then interpolates that string into a shell command executed via Ruby backticks. Because Ruby backticks pass the constructed string to the shell, any metacharacters inside the LDAP attribute become part of the command.
Exploitation does not require a domain join, trust relationship, or any special configuration between the SUSE host and the LDAP server. Simply browsing or editing a single crafted user entry is enough to launch the injected command as root.
Root Cause
The root cause is missing input validation on directory attributes that the code assumes are numeric. Rather than parsing shadowLastChange and shadowExpire as integers before use, yast2-users treats them as arbitrary strings and interpolates them directly into a shell invocation without quoting or escaping.
Attack Vector
An attacker with write access to a single user object in a connected LDAP directory sets shadowLastChange or shadowExpire to a value containing shell metacharacters and a payload command. When a SUSE administrator opens that user's Password Settings tab in yast2 users, the payload runs as root on the administrator's workstation or server. No prior trust between the SUSE host and the LDAP directory is required, and the attacker never needs local access to the target machine. See the SUSE Bug Report #1272839 for additional technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-59680
Indicators of Compromise
- Unexpected child processes of yast2, ruby, or yast2-users running shell commands, network utilities, or package managers as root.
- LDAP entries where shadowLastChange or shadowExpire contain non-numeric characters such as backticks, semicolons, $(, |, or whitespace.
- New root-owned files, cron entries, or SSH authorized_keys modifications created shortly after an administrator opened the Password Settings tab.
Detection Strategies
- Audit LDAP directories for user objects whose shadowLastChange or shadowExpire values fail an integer validation check.
- Correlate execution of /sbin/yast2 or the users module with subsequent unexpected sh, bash, curl, or wget process creation under the same session.
- Alert on YaST modules spawning outbound network connections, which is atypical during routine user administration.
Monitoring Recommendations
- Enable Linux auditd rules on execve calls whose parent is a Ruby interpreter launched by YaST.
- Log all administrative sessions that run yast2 users against remote or federated LDAP backends and review them for anomalies.
- Monitor LDAP write operations touching shadowLastChange and shadowExpire for values that deviate from an integer format.
How to Mitigate CVE-2026-59680
Immediate Actions Required
- Upgrade yast2-users to a version later than 5.0.8 as soon as a fixed package is published by SUSE.
- Avoid running yast2 users against untrusted or externally controlled LDAP directories until the patch is applied.
- Review LDAP directories for user entries with malformed shadowLastChange or shadowExpire values and remediate any suspicious records.
Patch Information
A fix is tracked in SUSE Bug Report #1272839. Administrators should install updated yast2-users packages once they are released through the SUSE and openSUSE update channels and confirm the installed version is greater than 5.0.8.
Workarounds
- Restrict LDAP write access so that only trusted administrators can modify shadow-related attributes on user objects.
- Manage LDAP-backed users with command-line tools such as ldapmodify instead of the YaST Password Settings tab until the fixed package is installed.
- Enforce schema-level constraints or LDAP access control lists that reject non-integer values for shadowLastChange and shadowExpire.
# Verify the installed yast2-users version and refuse to launch the module if vulnerable
rpm -q --qf '%{VERSION}\n' yast2-users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
