Description
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.






This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.
Published: 2026-07-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The suricata package on openSUSE Tumbleweed contains a Unix symbolic link following flaw that is triggered during its post‑install script. The flaw permits an unprivileged suricata user to create or influence a malicious symlink pointing to a privileged file, thereby allowing the suricata process to inadvertently overwrite root‑owned files. The result is local privilege escalation to root, corresponding to CWE‑59 (Relative Path Traversal) and CWE‑61 (Improper Control of File or Directory Access Path).

Affected Systems

All openSUSE Tumbleweed releases with Suricata before version 8.0.5-2.1 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, whereas the EPSS score of below 1% suggests a very low probability of exploitation today. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access that can influence the post‑install script or the creation of a crafted symbolic link, so the attack vector is local. Successful exploitation would give the attacker root privileges, affecting confidentiality, integrity, and availability of the host.

Generated by OpenCVE AI on July 31, 2026 at 10:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Suricata to version 8.0.5-2.1 or later from the openSUSE Tumbleweed repository.
  • If upgrading is not possible, uninstall or disable the Suricata service to eliminate the vulnerable account.
  • Monitor system logs and file creation events for suspicious symbolic links that point to privileged files and correct them if discovered.

Generated by OpenCVE AI on July 31, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-59
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

threat_severity

Important

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Suse
Suse opensuse Tumbleweed
Vendors & Products Suse
Suse opensuse Tumbleweed

Tue, 14 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Description A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.
Title LPE from suricata user to root due to chown in %post in suricata packaging
Weaknesses CWE-61
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/S:N'}

Subscriptions

Suse Opensuse Tumbleweed
cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2026-07-15T04:00:53.092Z

Reserved: 2026-07-06T11:59:28.118Z

Link: CVE-2026-59674

cve-icon Vulnrichment

Updated: 2026-07-14T12:33:13.348Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-14T07:32:35Z

Links: CVE-2026-59674 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T10:45:04Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')

  • CWE-61

    UNIX Symbolic Link (Symlink) Following