CVE-2026-109968
Medium · 5.5CVSS
5.5
EPSS
—
Published
Oct 14, 2026
CISA due date
—
The record
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62347 Element Call is a native Matrix video conferencing application. CWE-532
- CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for… CWE-532
- CVE-2026-119290 Zuke is a code-first, strongly typed build automation system for Deno. CWE-532
- CVE-2026-59388 Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances… CWE-532
- CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may… CWE-532
- CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable… CWE-532
- CVE-2026-79656 A user with read access to Grafana's server logs, or to a log store they are shipped to… CWE-532
- CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-532