Description
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Published: 2026-10-14
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Exposed PKCS#11 token PIN
Action: Apply Workaround
AI Analysis

Impact

The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN to a temporary file in plaintext and does not set restrictive permissions. Under the default process umask, the file is world‑readable, and if the script exits prematurely the file is not cleaned up, allowing any local user to read the PIN. The vulnerability is a classic information disclosure flaw (CWE‑538).

Affected Systems

This flaw affects Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. The affected product is the clevis PKCS#11 helper that is used for LUKS key management in these distributions.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: any user who can trigger the clevis‑luks‑pkcs11‑askpin script can read the world‑readable PIN file, giving them access to the PKCS#11 token and potentially compromising encrypted data. The risk remains moderate, but the low EPSS suggests limited active exploitation currently.

Generated by OpenCVE AI on October 16, 2026 at 00:14 UTC.

Remediation

Vendor Workaround

Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask by creating a service override using systemctl edit. Setting UMask to 0077 prevents the PIN file from being readable by non-root users. This workaround only covers the systemd service path. The dracut initramfs code path is not covered by this mitigation.

OpenCVE Recommended Actions

  • Configure the clevis‑luks‑pkcs11‑askpass systemd service with a restrictive UMask by creating a service override using systemctl edit and setting UMask to 0077 to prevent non‑root users from reading the PIN file.
  • Verify that no residual PIN files remain after clevis operations and delete any found files to ensure the temporary file is cleaned up even if the script exits unexpectedly.
  • Monitor for future vendor updates that address the clevis PKCS#11 PIN file permission issue and apply any official patches when they become available.

Generated by OpenCVE AI on October 16, 2026 at 00:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5

Sat, 24 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Red Hat
Red Hat enterprise Linux
Redhat openshift Container Platform
Vendors & Products Red Hat
Red Hat enterprise Linux
Redhat openshift Container Platform

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Title Clevis: clevis: pkcs#11 token pin written to world-readable file
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-538
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Red Hat Enterprise Linux
Redhat Enterprise Linux Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-30T07:22:49.914Z

Reserved: 2026-10-13T11:32:07.004Z

Link: CVE-2026-109970

cve-icon Vulnrichment

Updated: 2026-10-14T14:12:11.871Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T10:17:52.137

Modified: 2026-10-30T08:16:54.500

Link: CVE-2026-109970

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-109970 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T02:30:17Z

Weaknesses
  • CWE-538

    Insertion of Sensitive Information into Externally-Accessible File or Directory