CVE-2026-44944

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in open-iscsi via isscsiuio Control Socket

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: SUSE

Description

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-44944

Affected Vendors & Products

Vendor	Product	Version / Range
open-iscsi	open-iscsi	From ? (inc) to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

An Incorrect Authorization vulnerability in open-iscsi allows unprivileged local users to use the isscsiuio control socket. This means a user without proper permissions can interact with the control socket, potentially leading to unauthorized actions.

Detection Guidance

Detection requires checking for open-iscsi versions affected by the vulnerability. Inspect the installed version using commands like 'rpm -qa | grep open-iscsi' on RPM-based systems or 'dpkg -l | grep open-iscsi' on Debian-based systems. Verify if the version falls within the affected range.

Impact Analysis

This vulnerability could allow local users to perform actions they are not authorized for, potentially leading to system compromise or unauthorized access to sensitive data. The impact depends on the privileges of the affected system.

Compliance Impact

The vulnerability allows unprivileged local users to exploit incorrect authorization in open-iscsi, potentially leading to unauthorized access or control. This could impact compliance with standards like GDPR or HIPAA by enabling data breaches or unauthorized data access, depending on system configuration and usage.

Mitigation Strategies

Update open-iscsi to a patched version immediately. If no patch is available, consider disabling the isscsiuio control socket or restricting local user access to it. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-44944. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70