CVE-2026-59674 — LPE from suricata user to root due to chown in %post in suricata packaging

CVE-2026-59674

LPE from suricata user to root due to chown in %post in suricata packaging PUBLISHED

Description (CNA)

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.

Affected (CNA)

Vendor / product	Versions
SUSE / openSUSE Tumbleweed	affected ? before 8.0.5-2.1
SUSE / openSUSE Tumbleweed	affected ? before 8.0.5-2.1

CWE

CWE-61

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-59674

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.