The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN to a temporary file in plaintext and does not set restrictive permissions. Under the default process umask, the file is world‑readable, and if the script exits prematurely the file is not cleaned up, allowing any local user to read the PIN. The vulnerability is a classic information disclosure flaw (CWE‑538).

This flaw affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. The affected product is the clevis PKCS#11 helper that is used for LUKS key management in these distributions.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: any user who can trigger the clevis‑luks‑pkcs11‑askpin script can read the world‑readable PIN file, giving them access to the PKCS#11 token and potentially compromising encrypted data. The risk remains moderate, but the low EPSS suggests limited active exploitation currently.