Skip to content
Fencer Vulns
medium 6.8

CVE-2026-23893 json

openCryptoki has improper link resolution before file access (link following)

published 2026-01-22 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4203

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication.

Patch / fix

  • opencryptoki Debian 13 3.23.0+dfsg-0.3+deb13u1
  • opencryptoki Debian 14 3.27.0-1

debian advisories DEBIAN-CVE-2026-23893

  • opencryptoki Ubuntu 22.04 LTS 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3
  • opencryptoki Ubuntu 24.04 LTS 3.23.0+dfsg-0ubuntu3.1
  • opencryptoki Ubuntu 26.04 LTS 3.26.0+dfsg-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2026-23893

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • opencryptoki RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-libs RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-swtok RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-ccatok RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-icatok RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-ep11tok RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki-icsftok RHEL 9 3.25.0-4.el9_7.2
  • opencryptoki RHEL 8 3.22.0-3.el8_10.2

red hat advisories RHSA-2026:6006RHSA-2026:5919RHSA-2026:5917RHSA-2026:5603RHSA-2026:5587RHSA-2026:4717

  • openCryptoki SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.27.0-160000.1.1
  • openCryptoki SLE Micro 5.4 3.17.0-150400.4.11.1
  • openCryptoki SLE Micro 5.5 3.23.0-150500.3.12.1
  • openCryptoki SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.26.0-160000.1.1
  • openCryptoki SLE Module for Server Applications 15 SP7 3.26.0-150700.5.12.1
  • openCryptoki openSUSE Leap 15.6 3.23.0-150600.3.14.1
  • openCryptoki SLES LTSS Extended Security 12 SP5 3.17.0-5.19.2

suse advisories SUSE-SU-2026:22293-1SUSE-SU-2026:22365-1SUSE-SU-2026:0824-1SUSE-SU-2026:0581-1SUSE-SU-2026:0569-1SUSE-SU-2026:20434-1

  • openCryptoki openSUSE Leap 16.0 3.27.0-160000.1.1
  • openCryptoki openSUSE Leap 16.0 3.26.0-160000.1.1
  • openCryptoki openSUSE Tumbleweed 3.26.0-4.1

opensuse advisories openSUSE-SU-2026:21059-1openSUSE-SU-2026:20233-1openSUSE-SU-2026:10086-1

  • opencryptoki AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-libs AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-swtok AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-ccatok AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-icatok AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-tpmtok AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-ep11tok AlmaLinux 8 3.22.0-3.el8_10.2
  • opencryptoki-icsftok AlmaLinux 8 3.22.0-3.el8_10.2

almalinux advisories ALSA-2026:5587ALSA-2026:5603

  • opencryptoki Rocky Linux 9 3.25.0-4.el9_7.2
  • opencryptoki Rocky Linux 8 3.22.0-3.el8_10.2
  • opencryptoki Rocky Linux 10 3.25.0-5.el10_1.2

rocky linux advisories RLSA-2026:5603RLSA-2026:5587RLSA-2026:4717

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-23893 updated cvss 6.8

openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

  • Red Hat Enterprise Linux 6 opencryptoki, opencryptoki-libs Red Hat Enterprise Linux 7 opencryptoki, opencryptoki-libs, opencryptoki-swtok, opencryptoki-ccatok, opencryptoki-icatok, opencryptoki-tpmtok, +2 more
    affected: workaround, no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) opencryptoki-devel 3.22.0-3.el9_4.2, opencryptoki-debuginfo 3.22.0-3.el9_4.2, opencryptoki-debugsource 3.22.0-3.el9_4.2, opencryptoki-libs-debuginfo 3.22.0-3.el9_4.2, opencryptoki-swtok-debuginfo 3.22.0-3.el9_4.2, opencryptoki-ccatok-debuginfo 3.22.0-3.el9_4.2, +3 more
    fixed: vendor fix RHSA-2026:6006
  • Red Hat CodeReady Linux Builder EUS (v.9.6) opencryptoki-devel 3.24.0-5.el9_6.1, opencryptoki-debuginfo 3.24.0-5.el9_6.1, opencryptoki-debugsource 3.24.0-5.el9_6.1, opencryptoki-libs-debuginfo 3.24.0-5.el9_6.1, opencryptoki-swtok-debuginfo 3.24.0-5.el9_6.1, opencryptoki-ccatok-debuginfo 3.24.0-5.el9_6.1, +3 more
    fixed: vendor fix RHSA-2026:5919
  • Red Hat Enterprise Linux BaseOS (v. 8) opencryptoki 3.22.0-3.el8_10.2, opencryptoki-libs 3.22.0-3.el8_10.2, opencryptoki-swtok 3.22.0-3.el8_10.2, opencryptoki-ccatok 3.22.0-3.el8_10.2, opencryptoki-icatok 3.22.0-3.el8_10.2, opencryptoki-tpmtok 3.22.0-3.el8_10.2, +2 more
    fixed: vendor fix RHSA-2026:5587
  • Red Hat Enterprise Linux BaseOS (v. 9) opencryptoki 3.25.0-4.el9_7.2, opencryptoki-libs 3.25.0-4.el9_7.2, opencryptoki-swtok 3.25.0-4.el9_7.2, opencryptoki-ccatok 3.25.0-4.el9_7.2, opencryptoki-icatok 3.25.0-4.el9_7.2, opencryptoki-ep11tok 3.25.0-4.el9_7.2, +1 more
    fixed: vendor fix RHSA-2026:5603
  • Red Hat Enterprise Linux BaseOS (v. 10) opencryptoki 3.25.0-5.el10_1.2, opencryptoki-libs 3.25.0-5.el10_1.2, opencryptoki-swtok 3.25.0-5.el10_1.2, opencryptoki-ccatok 3.25.0-5.el10_1.2, opencryptoki-icatok 3.25.0-5.el10_1.2, opencryptoki-ep11tok 3.25.0-5.el10_1.2, +1 more
    fixed: vendor fix RHSA-2026:4717
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) opencryptoki 3.24.0-6.el10_0.1, opencryptoki-libs 3.24.0-6.el10_0.1, opencryptoki-swtok 3.24.0-6.el10_0.1, opencryptoki-ccatok 3.24.0-6.el10_0.1, opencryptoki-icatok 3.24.0-6.el10_0.1, opencryptoki-ep11tok 3.24.0-6.el10_0.1, +1 more
    fixed: vendor fix RHSA-2026:5917
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) opencryptoki 3.22.0-3.el9_4.2, opencryptoki-libs 3.22.0-3.el9_4.2, opencryptoki-swtok 3.22.0-3.el9_4.2, opencryptoki-ccatok 3.22.0-3.el9_4.2, opencryptoki-icatok 3.22.0-3.el9_4.2, opencryptoki-ep11tok 3.22.0-3.el9_4.2, +1 more
    fixed: vendor fix RHSA-2026:6006
show 5 more
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) opencryptoki 3.24.0-5.el9_6.1, opencryptoki-libs 3.24.0-5.el9_6.1, opencryptoki-swtok 3.24.0-5.el9_6.1, opencryptoki-ccatok 3.24.0-5.el9_6.1, opencryptoki-icatok 3.24.0-5.el9_6.1, opencryptoki-ep11tok 3.24.0-5.el9_6.1, +1 more
    fixed: vendor fix RHSA-2026:5919
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) opencryptoki-devel 3.25.0-4.el9_7.2, opencryptoki-debuginfo 3.25.0-4.el9_7.2, opencryptoki-debugsource 3.25.0-4.el9_7.2, opencryptoki-libs-debuginfo 3.25.0-4.el9_7.2, opencryptoki-swtok-debuginfo 3.25.0-4.el9_7.2, opencryptoki-ccatok-debuginfo 3.25.0-4.el9_7.2, +3 more
    fixed: vendor fix RHSA-2026:5603
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) opencryptoki-devel 3.25.0-5.el10_1.2, opencryptoki-debuginfo 3.25.0-5.el10_1.2, opencryptoki-debugsource 3.25.0-5.el10_1.2, opencryptoki-libs-debuginfo 3.25.0-5.el10_1.2, opencryptoki-swtok-debuginfo 3.25.0-5.el10_1.2, opencryptoki-ccatok-debuginfo 3.25.0-5.el10_1.2, +3 more
    fixed: vendor fix RHSA-2026:4717
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) opencryptoki-devel 3.24.0-6.el10_0.1, opencryptoki-debuginfo 3.24.0-6.el10_0.1, opencryptoki-debugsource 3.24.0-6.el10_0.1, opencryptoki-libs-debuginfo 3.24.0-6.el10_0.1, opencryptoki-swtok-debuginfo 3.24.0-6.el10_0.1, opencryptoki-ccatok-debuginfo 3.24.0-6.el10_0.1, +3 more
    fixed: vendor fix RHSA-2026:5917
  • Red Hat Enterprise Linux CRB (v. 8) opencryptoki-devel 3.22.0-3.el8_10.2, opencryptoki-debuginfo 3.22.0-3.el8_10.2, opencryptoki-debugsource 3.22.0-3.el8_10.2, opencryptoki-libs-debuginfo 3.22.0-3.el8_10.2, opencryptoki-swtok-debuginfo 3.22.0-3.el8_10.2, opencryptoki-ccatok-debuginfo 3.22.0-3.el8_10.2, +4 more
    fixed: vendor fix RHSA-2026:5587

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Affected products

  • opencryptoki opencryptoki

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.