CVE-2026-26104
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Feb 25, 2026
CISA due date
—
The record
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | udisks2 | 0 | 2.11.0-2.1 |
Related vulnerabilities
- CVE-2026-26103 A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus… Also affects udisks2
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862
- CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful… CWE-862
- CVE-2026-84916 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. CWE-862