Loading story…
libcap version 2.78 was released to fix CVE-2026-4878, a time-of-check/time-of-use privilege escalation vulnerability affecting releases from 2.04 through 2.77. The flaw was described as a local issue with a CVSS 3.1 score of 7.0 and vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, with impact on confidentiality, integrity, and availability. Andrew G. Morgan said the fix is available publicly in commit 286ace1259992bd0c5d9016715833f2e148ac596, and that no embargo remained because the code was already public.
Discussion on the oss-security list added that the vulnerability had been documented in a private Red Hat Bugzilla entry and was expected to receive a GitHub advisory later in the week. In follow-up, Christian Göttsche asked whether the updated code intentionally permits changing file capabilities for all file types, rather than only regular files, when the caller has read permissions. Morgan also said earlier attempts to report the issue privately to the Openwall list failed after his messages bounced and the notices were filtered into Gmail spam.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Andrew G. Morgan said the GitHub security advisory and libcap release notes were updated to fully document CVE-2026-4878 publicly. The advisory rated the TOCTOU privilege escalation flaw as CVSS 7.0 and linked the already-public fix commit.
In follow-up discussion, Christian Göttsche asked whether the new code intentionally permits changing file capabilities for all file types, not only regular files, when the caller has read permissions. Morgan responded in the thread while also noting earlier attempts to report the issue privately to Openwall had failed due to bounced emails being filtered as spam.
The public disclosure described the vulnerability as a local TOCTOU privilege escalation issue with CVSS 7.0 and vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. Morgan said there was no embargo because the code was already public, referenced a private Red Hat Bugzilla entry, and said a GitHub advisory would follow later that week.
Andrew G. Morgan announced libcap 2.78 as a fix for a TOCTOU privilege escalation vulnerability tracked as CVE-2026-4878. The flaw affects libcap versions 2.04 through 2.77, and the public fix was identified as commit 286ace1259992bd0c5d9016715833f2e148ac596.
An upstream libcap commit introduced a fix for the TOCTOU race condition in cap_set_file() by switching to safer file-descriptor-based handling, blocking symlink abuse, and validating regular files. The patch also updated tests to verify safe capability setting and failure when removing capabilities through a symlinked path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
10 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed **CVE-2026-4878**, an Important local privilege-escalation flaw in `libcap` caused by a time-of-check-to-time-of-use race in the `cap_set_file()` function. The bug allows a local unprivileged attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file, potentially injecting or stripping capabilities from unintended executables. Red Hat said the issue can be triggered when privileged processes such as `setcap` or container tooling operate on attacker-influenced paths, assigned it a **CVSS v3 score of 6.7**, and classified it as **CWE-367**. No mitigation meeting Red Hat's criteria was listed, and the issue was credited to **Ali Raza**. Red Hat issued security errata across multiple product streams for **Red Hat Enterprise Linux 8, 9, and 10**, including standard, Extended Update Support, SAP, telecommunications, mission-critical, and Extended Life Cycle channels. Published fixes include `libcap-2.69-7.el10_1.1` and `2.69-7.el10_2.1` for RHEL 10, `libcap-2.48-10.el9_7.1` and `2.48-10.el9_8.1` for RHEL 9, and `libcap-2.48-4.el8_6.1` plus `2.48-5.el8_8.1` for affected RHEL 8 streams. Red Hat advised customers to apply the updated packages through the relevant RHSA advisories to remediate the vulnerability.
Aug 25, 2026
A use-after-free flaw in the Linux kernel's Netfilter nftables `nft_pipapo_walk` function, tracked as **CVE-2023-6817**, can allow a local attacker with `CAP_NET_ADMIN` to crash a host, disclose information, or elevate privileges. The defect allowed inactive PIPAPO set elements to be processed and deactivated twice during a set walk, leading to a kernel crash; it carries a CVSS v3.1 score of 7.8. Linux kernel commit `317eb9685095678f2c9f5a8189de698c5354316a` fixes the issue by verifying that an element is active before invoking the iterator callback. Red Hat issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; systems with unprivileged user namespaces enabled may let unprivileged users obtain the required capability. OpenShift Container Platform inherits the affected code through RHCOS, but Red Hat rates impact as Low because its namespace model prevents containers from acquiring the capabilities needed to exploit the flaw.
Aug 26, 2026
Cacti disclosed a **critical unauthenticated local file inclusion** flaw, tracked as **`CVE-2026-39938`** and **`GHSA-rm7p-qcqm-x5m6`**, affecting versions up to and including **`1.2.30`**. The issue stems from the `graph_theme` parameter and can be exploited over the network without privileges or user interaction, earning a **CVSS 3.1 score of 9.8**. The advisory also notes related hardening for **rrdtool IPC serialization**, with the weakness associated with path traversal and potential OS command injection concerns. An earlier security change in the `1.2.x` branch sanitized `graph_theme` with PHP `basename()` and rejected empty, `.` and `..` values in `lib/rrd.php`, falling back to the selected theme when input was invalid. Cacti later determined that approach was bypassable and replaced it with stronger **filesystem allowlist validation** in `cacti_validate_theme()`. The vendor fixed the vulnerability in **`1.2.31`**, making that release the recommended upgrade target for exposed deployments.
Jun 29, 2026