CVE-2026-109971

Awaiting Analysis Awaiting Analysis - Queue

Clevis PKCS#11 PIN Exposure via Command-Line Argument

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109971

EUVD

EUVD-2026-100956

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-214	A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

Attack-Flow Graph

Executive Summary

This vulnerability involves the clevis PKCS#11 pin feature where the clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool. This makes the PIN visible to any local user through process listing or the /proc filesystem.

Detection Guidance

Check running processes for pkcs11-tool with command-line arguments containing the PIN. Use commands like ps aux | grep pkcs11-tool or inspect /proc/<pid>/cmdline for the vulnerable script execution.

Impact Analysis

An attacker with physical access to the PKCS#11 token could capture the PIN from command-line arguments during system boot. This could allow unauthorized private key operations, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability exposes the PKCS#11 token PIN through command-line arguments, which could lead to unauthorized access to sensitive data. For GDPR, this may violate principles of data protection and confidentiality. For HIPAA, it could compromise protected health information if the token is used in healthcare systems.

Mitigation Strategies

Update the clevis-decrypt-pkcs11 script to pass the PIN via environment variable (e.g., -p env:CLEVIS_PKCS11_PIN) instead of command line. Monitor for script updates from Red Hat.

Hi! I’m here to help you understand CVE-2026-109971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70