CVE-2026-59680
Received Received - Intake

OS Command Injection in yast2-users

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: SUSE

Description
An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping. Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry. This issue affects yast2-users through 5.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-59680
EUVD
EUVD-2026-68996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
suse yast2-users to 5.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an OS command injection vulnerability in yast2-users. When viewing or editing a user's 'Password Settings' tab, the application reads unvalidated numeric fields from an external LDAP directory and passes them directly to a shell command without proper escaping or quoting. This allows an administrator managing users to trigger root-level command execution simply by accessing that user's settings.

Detection Guidance

To detect this vulnerability, check if yast2-users version 5.0.8 or earlier is installed on your system. Run: zypper info yast2-users. If the version is 5.0.8 or below, the system is vulnerable.

Impact Analysis

If you are an administrator using yast2-users to manage accounts against an external LDAP directory, viewing or editing a specific user's 'Password Settings' tab could allow an attacker to execute arbitrary root commands on your system. No additional setup like domain joining is required for exploitation.

Compliance Impact

This vulnerability allows root command execution when an administrator views or edits a user's 'Password Settings' tab in yast2-users, particularly for LDAP users. This could lead to unauthorized access, data breaches, or data manipulation, which are critical violations under GDPR and HIPAA. Unauthorized root access may result in non-compliance with data protection and security requirements.

Mitigation Strategies

Update yast2-users to the latest version immediately. Use: zypper update yast2-users. Avoid using the 'Password Settings' tab for LDAP users until patched. Restrict administrative access to yast2 users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart