The flaw occurs in the clevis PKCS#11 unlock daemon, where the LUKS passphrase is written in clear text to a log file. The log is created without restrictive permissions, making it world‑readable due to the default process umask. A local attacker can read the file and retrieve the passphrase, enabling decryption of the encrypted disk. This vulnerability is identified as CWE‑532.

The affected platforms are Red Hat Enterprise Linux 10, 9, 8, 7 and Red Hat OpenShift Container Platform 4. The flaw manifests in the clevis‑pkcs11‑afunix‑socket‑unlock daemon that writes the plaintext log during normal operation.

The CVSS score of 5.5 indicates moderate severity. The EPSS score indicates an exploitation probability of less than 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: the attacker must have read access to the log file located at /run/systemd/clevis‑pkcs11‑*.log. Because the file permissions allow any local user to read it, exploitation is straightforward once the file is present. Once a passphrase is obtained, the confidentiality of the protected data is fully compromised.