A missing authorization check in the udisks storage‑management daemon allows any local user who is not privileged to access a D‑Bus method that exports LUKS encryption headers. Because the method lacks a policy check, an attacker can read the header metadata and then copy it to a location of their choice. The leaked metadata includes cryptographic keys and configuration that are critical for the confidentiality of encrypted volumes, which is a classic example of CWE‑862 – Missing Authorization. This flaw does not directly grant direct cryptographic material but weakens the secrecy of the encryption scheme.

The vulnerability affects several Red Hat Enterprise Linux releases, including RHEL 6, 7, 8, 9, and RHEL 10 (including the 10.0 extended update support branch). It also applies to the underlying udisks package (version 2.0.0 as seen in the CPE list). Administrators of these platforms should verify that the affected udisks binary is still in use and that no service has been reverted to an older, vulnerable version.

With a CVSS base score of five point five the overall severity is moderate, and an EPSS score of less than one percent indicates a very low probability of exploitation at this time. The vulnerability is not yet featured in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that attacks would be carried out locally on the system via D‑Bus, and that no network exposure is required. Because the flaw permits reading of encryption headers, any unprivileged user could facilitate a downgrade or a future brute‑force attack on the cipher. Prompt remediation is advised, especially on systems exposing the default udisks policy to multiple users.