Vulnerability in Uutils Coreutils
CVE-2026-35341
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.
EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- security@ubuntu.com (issue-tracking, Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35341?
- CVE-2026-35341 is a high-severity vulnerability in Uutils Coreutils, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.1/10. Published 2026-04-22.
- How severe is CVE-2026-35341?
- High severity. CVSS v3 base score is 7.1 out of 10.