Executive Summary

CVE-2026-27189 is a race condition vulnerability in OpenSift versions 1.1.2-alpha and below. It affects the local JSON persistence mechanisms used by various components such as session, study, quiz, flashcard, wellness, and authentication stores.

The issue arises because the local persistence operations are non-atomic and insufficiently synchronized, meaning that concurrent operations can interfere with each other. This can lead to lost updates or corrupted local state across different sessions or stores.

The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition).

The problem was fixed in OpenSift version 1.1.3-alpha by implementing lock-guarded atomic writes and synchronizing shared in-memory mutation paths to prevent race conditions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause high integrity loss due to corrupted or lost data in local JSON persistence stores used by OpenSift.

Specifically, concurrent operations may overwrite or corrupt session, study, quiz, flashcard, wellness, or authentication data, potentially leading to inconsistent or incorrect application behavior.

The attack vector is local, requiring low privileges and no user interaction, so an attacker with local access could exploit this to cause data corruption.

Confidentiality and availability impacts are low, but the integrity impact is high, meaning the main risk is incorrect or lost data rather than data exposure or denial of service.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from race conditions in local JSON persistence within OpenSift versions 1.1.2-alpha and below, causing potential state corruption or lost updates during concurrent operations.

Detection involves checking the version of OpenSift installed on your system to see if it is vulnerable (i.e., version 1.1.2-alpha or below).

Since the issue is local and related to file persistence, network detection is not applicable.

• Run a command to check the OpenSift version, for example: `opensift --version` or check the version in the installed package metadata.
• Inspect the presence of affected Python modules (flashcard_store.py, opensift.py, quiz_store.py, session_store.py, study_store.py, test_auth_session_streaming.py, wellness.py) and verify if they are from a vulnerable version.

No specific commands for detecting race conditions or corrupted state files are provided in the resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade OpenSift to version 1.1.3-alpha or later, where the vulnerability has been fixed.

The fix involves migrating local JSON persistence to lock-guarded atomic writes, preventing race conditions and state corruption.

Until the upgrade is applied, avoid running concurrent operations that modify local JSON persistence stores to reduce the risk of corruption.

Useful 0 Not Useful 0