Description
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Published: 2026-10-14
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure (PIN disclosure to local users)
Action: Patch immediately
AI Analysis

Impact

The clevis-decrypt-pkcs11 script passes a PKCS#11 token PIN as a command‑line argument to pkcs11-tool. This makes the PIN visible to any local user through process listings or the /proc filesystem, allowing compromise of the token’s secrets. The vulnerability is a classic Sensitive Data Exposure flaw identified as CWE-214.

Affected Systems

Red Hat Enterprise Linux 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4 – any installation that uses the default clevis-decrypt-pkcs11 script is affected.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity, but the EPSS score of <1% and the fact that the issue is not listed in the CISA KEV catalog suggest a low likelihood of widespread exploitation. The attack vector is local; a user who can run or view the clevis-decrypt-pkcs11 script can read the PIN.

Generated by OpenCVE AI on October 14, 2026 at 14:44 UTC.

Remediation

Vendor Workaround

No end-user mitigation is available for this issue. The PIN exposure occurs in the clevis-decrypt-pkcs11 script itself, which must be updated to pass the PIN through an environment variable instead of the command line.

OpenCVE Recommended Actions

  • Update to the patched version of clevis‑decrypt‑pkcs11 supplied by Red Hat that passes the PIN via an environment variable instead of the command line.
  • If a patch is not yet available, restrict execution of the clevis‑decrypt‑pkcs11 script to trusted users only or remove it from systems where it is not required.
  • Monitor process listings for the presence of pkcs11-tool with a PIN argument and alert on anomalies.
  • Optionally enforce SELinux or AppArmor restrictions to prevent local users from inspecting command‑line arguments.

Generated by OpenCVE AI on October 14, 2026 at 14:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Title Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-214
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Redhat Enterprise Linux Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-14T11:22:01.649Z

Reserved: 2026-10-13T11:32:07.005Z

Link: CVE-2026-109971

cve-icon Vulnrichment

Updated: 2026-10-14T11:21:33.153Z

cve-icon NVD

Status : Received

Published: 2026-10-14T10:17:53.440

Modified: 2026-10-14T12:17:17.587

Link: CVE-2026-109971

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T14:45:02Z

Weaknesses
  • CWE-214

    Invocation of Process Using Visible Sensitive Information