CVE-2026-19816
Received Received - Intake

PackageKit dnf5 Backend Privilege Escalation via SIMULATE Flag

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Fedora Project

Description
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-19816

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
packagekit packagekit *
packagekit packagekit From 1.3.4 (inc) to 1.3.6 (inc)
packagekit packagekit 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19816 is a flaw in PackageKit's dnf5 backend where the SIMULATE flag is ignored during repository removal operations. This allows an unprivileged local user to perform a real package uninstallation while claiming to simulate it, bypassing the required polkit authorization check. The issue occurs because the RepoRemove handler always executes transactions regardless of the SIMULATE flag.

Detection Guidance

Check PackageKit version with 'pkcon --version' or 'rpm -q PackageKit'. If using versions 1.3.4 through 1.3.6 with dnf5 backend, the system is vulnerable. Review logs for unauthorized package removals or polkit bypass attempts.

Impact Analysis

An attacker could exploit this to uninstall critical system packages, including those owning repository configuration files. If autoremove is enabled, they could remove all packages from a specific repository. This could lead to system instability, denial of service, or loss of functionality depending on which packages are removed.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it is a local privilege escalation issue in PackageKit's dnf5 backend. It allows unprivileged users to perform unauthorized package removals, which could lead to system instability or denial of service but does not involve unauthorized data access or disclosure required for GDPR/HIPAA violations.

Mitigation Strategies

Upgrade PackageKit to version 1.4.0 or later. Disable PackageKit services temporarily if immediate upgrade isn't possible. Monitor for suspicious package removal activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart