The flaw exists when Pardus Domain Joiner starts an external process using credentials or other sensitive data supplied as command‑line arguments or in the environment. Because those values are visible to the operating system, they can be read by other processes or monitoring utilities, providing an attacker with the ability to harvest authentication information and potentially move laterally within the domain. The weakness corresponds to CWE‑214 and is assessed with a CVSS v3.1 base score of 7.9, indicating high severity.

TUBITAK BILGEM Software Technologies Research Institute’s Pardus Domain Joiner is affected. Versions from 0.5.2 up to, but not including, 0.5.4 (i.e., 0.5.2 and 0.5.3) contain the flaw.

The EPSS value of less than 1 % indicates a very low current likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need the ability to run or influence the domain joiner binary, typically requiring local execution or privileged access. Once executed, the command‑line arguments or environment variables containing credentials become visible to co‑resident processes, allowing them to capture the sensitive data. If an attacker succeeds, the compromised credentials could be reused for lateral movement or unauthorized access to domain resources.