https://vulnerability.circl.lu/sightings/feed 2026-05-09T05:55:17.175390+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a475ed1f-5c24-4148-b0f2-c60ca70217f5/export 2026-05-09T05:55:17.562086+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "a475ed1f-5c24-4148-b0f2-c60ca70217f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6970", "type": "seen", "source": "https://bsky.app/profile/mel-echosphere.bsky.social/post/3mklfebpkit2s", "content": "", "creation_timestamp": "2026-04-28T20:11:02.059765Z"} 2026-04-28T20:11:02.059765+00:00 https://vulnerability.circl.lu/sighting/7f0f3e5d-f4ed-42af-a537-a4fee7c21544/export 2026-05-09T05:55:17.561904+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "7f0f3e5d-f4ed-42af-a537-a4fee7c21544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6970", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mkrkpz77ed26", "content": "authd CVE-2026-6970: Local privilege escalation. GIDs reset to UIDs on login, breaking access and opening doors. Patch to 0.6.4 now. #LPE #LinuxSec #authd\n\n https://www.valtersit.com/cve/2026/04/cve-2026-6970/", "creation_timestamp": "2026-05-01T07:03:02.566313Z"} 2026-05-01T07:03:02.566313+00:00 https://vulnerability.circl.lu/sighting/54d17ea2-b087-4a5a-9cb7-7e7344fc838c/export 2026-05-09T05:55:17.558564+00:00 Automation user http://vulnerability.circl.lu/user/automation {"uuid": "54d17ea2-b087-4a5a-9cb7-7e7344fc838c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6970", "type": "seen", "source": "https://gist.github.com/alon710/cdeb633d740e110eed8363124062a03a", "content": "# CVE-2026-6970: CVE-2026-6970: Local Privilege Escalation via Improper GID Assignment in Canonical authd\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-05-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-6970\n\n## Summary\nCanonical authd versions prior to 0.6.4 contain a local privilege escalation and denial of service vulnerability stemming from a logic error in primary group ID (GID) assignment. The daemon improperly overwrites intentional administrative GID configurations during identity provider synchronization events.\n\n## TL;DR\nCanonical authd incorrectly overwrites custom user GIDs with their UID during identity syncs. This logic flaw permits local privilege escalation via group collision and causes denial of service through incorrect file ownership.\n\n## Technical Details\n\n- **CVE ID**: CVE-2026-6970\n- **CVSS v4.0**: 7.3 (High)\n- **Attack Vector**: Local (AV:L)\n- **EPSS Score**: 0.00015 (2.93%)\n- **CWE ID**: CWE-842\n- **Impact**: Local Privilege Escalation, Denial of Service\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Canonical authd\n- **authd**: < 0.6.4 (Fixed in: `0.6.4`)\n- **authd**: = 0.6.0 (Fixed in: `0.6.1ubuntu0.1`)\n- **authd**: >= 0.6.1, < 0.6.1ubuntu0.1 (Fixed in: `0.6.1ubuntu0.1`)\n\n## Mitigation\n\n- Upgrade authd to a patched release (0.6.4 upstream or 0.6.1ubuntu0.1 for Ubuntu).\n- Audit existing user database records to identify mismatched GID assignments.\n- Perform filesystem scans to correct ownership of files created under vulnerable daemon versions.\n\n**Remediation Steps:**\n1. Execute `apt update && apt upgrade authd` to install the patched version.\n2. Run `getent passwd` and map intended group configurations against the current system state.\n3. Use `authctl group set-gid` to restore any custom GID assignments that were overwritten prior to patching.\n4. Execute `find / -type f -uid -gid ` in shared directories to identify incorrectly owned files and run `chgrp` to restore appropriate group ownership.\n\n## References\n\n- [NVD - CVE-2026-6970](https://nvd.nist.gov/vuln/detail/CVE-2026-6970)\n- [GitHub Advisory GHSA-fg3j-5w9g-hmg7](https://github.com/canonical/authd/security/advisories/GHSA-fg3j-5w9g-hmg7)\n- [Fix Commit 154b428305cb1a7a19c897626fefd09d6dde8b9f](https://github.com/canonical/authd/commit/154b428305cb1a7a19c897626fefd09d6dde8b9f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-6970) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-06T07:40:29.000000Z"} 2026-05-06T07:40:29+00:00