CVE-2026-109970
Medium · 4.7CVSS
4.7
EPSS
—
Published
Oct 14, 2026
CISA due date
—
The record
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119199 Nuxt is an open-source web development framework for Vue.js. CWE-538
- CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538)… CWE-538
- CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538)… CWE-538
- CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory… CWE-538
- CVE-2026-19229 A vulnerability was determined in SourceCodester Online Clothing Store. CWE-538
- CVE-2026-12762 IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a… CWE-538
- CVE-2026-15574 A flaw was found in the vllm-orchestrator-gateway component. CWE-538
- GHSA-9c83-rr99-vfwj MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at… CWE-538