CVE-2026-45254
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
May 21, 2026
CISA due date
—
The record
In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
- CVE-2026-95837 containerd is an open-source container runtime. CWE-269
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
- CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
- CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269
- CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role… CWE-269
- CVE-2026-75777 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape… CWE-269