CVE-2026-44944

Received Received - Intake

Incorrect Authorization in open-iscsi via isscsiuio Control Socket

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: SUSE

Description

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket. This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-44944

Affected Vendors & Products

Vendor	Product	Version / Range
open-iscsi	open-iscsi	From ? (inc) to 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

An Incorrect Authorization vulnerability in open-iscsi allows unprivileged local users to use the isscsiuio control socket. This means a user without proper permissions can interact with the control socket, potentially leading to unauthorized actions.

Detection Guidance

Detection requires checking for open-iscsi versions affected by the vulnerability. Inspect the installed version using commands like 'rpm -qa | grep open-iscsi' on RPM-based systems or 'dpkg -l | grep open-iscsi' on Debian-based systems. Verify if the version falls within the affected range.

Impact Analysis

This vulnerability could allow local users to perform actions they are not authorized for, potentially leading to system compromise or unauthorized access to sensitive data. The impact depends on the privileges of the affected system.

Mitigation Strategies

Update open-iscsi to a patched version immediately. If no patch is available, consider disabling the isscsiuio control socket or restricting local user access to it. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-44944. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70