{"id":"CVE-2026-109970","aliases":[],"cve":{"records":[{"id":"CVE-2026-109970","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-13T11:32:07.004Z","published":"2026-10-14T10:01:01.533Z","modified":"2026-10-30T07:22:49.914Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-10-30T07:22:49.914Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-14T14:12:15.165Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-109970","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550362","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-538","description":"Insertion of Sensitive Information into Externally-Accessible File or Directory","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-14T14:12:05.942458Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Clevis: clevis: pkcs#11 token pin written to world-readable file","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.","score":4.7,"severity":"medium","published":"2026-10-14T10:01:01.533Z","modified":"2026-10-30T07:22:49.914Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"}],"remediation":[{"text":"Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask by creating a service override using systemctl edit. Setting UMask to 0077 prevents the PIN file from being readable by non-root users.\n\nThis workaround only covers the systemd service path. The dracut initramfs code path is not covered by this mitigation.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"}],"references":["https://access.redhat.com/security/cve/CVE-2026-109970","https://bugzilla.redhat.com/show_bug.cgi?id=2550362"],"sources":[{"name":"CVE","id":"CVE-2026-109970","modified":"2026-10-30T07:22:49.914Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":4.7}],"sourceAffected":[],"observedAt":"2026-10-30T07:31:10.231Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:15:35.655Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T07:35:33.882Z","attemptedAt":"2026-10-30T07:35:33.882Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T07:35:34.457Z","attemptedAt":"2026-10-30T07:35:34.457Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T07:35:34.322Z","attemptedAt":"2026-10-30T07:35:34.322Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T07:35:33.911Z","attemptedAt":"2026-10-30T07:35:33.911Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-109970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109970","modified":"2026-10-15T16:33:26.290","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-30T07:35:33.882Z"},{"source":"FIRST EPSS","id":"CVE-2026-109970","url":"https://www.first.org/epss/","probability":0.00123,"percentile":0.02077,"date":"2026-10-29","checkedAt":"2026-10-30T07:35:33.911Z"},{"source":"ENISA EUVD","id":"EUVD-2026-100955","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100955","modified":"Oct 14, 2026, 2:12:15 PM","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-30T07:35:34.322Z"},{"source":"GitHub Advisory Database","id":"GHSA-px84-jf5m-hcjv","url":"https://github.com/advisories/GHSA-px84-jf5m-hcjv","modified":"2026-10-14T12:31:40Z","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-10-30T07:35:34.457Z"}],"aiSummary":{"text":"Clevis in Red Hat Enterprise Linux 7, 8, 9, and 10 writes the PKCS#11 token PIN to a world-readable file. The file may not be cleaned up if the decryption script exits early. Local access is required to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:41:58.511Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-109970"}]}}