CVE-2025-27512

Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory.

• CWE-783
• CWE-863

• https://github.com/coreos/zincati/commit/01d8e89f799e6ba21bdf7dc668abce23bd0d8f78
• https://github.com/coreos/zincati/commit/28a43aa2c1edda091ba659677d73c13e6e3ea99d
• https://github.com/coreos/zincati/releases/tag/v0.0.24
• https://github.com/coreos/zincati/releases/tag/v0.0.30
• https://github.com/coreos/zincati/security/advisories/GHSA-w6fv-6gcc-x825

Published

Mar 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27507The open-source identity infrastructure software Zitadel all…9
• CVE-2025-27508Emissary is a P2P based data-driven workflow engine. The Che…7.5
• CVE-2025-27509fleetdm/fleet is an open source device management, built on …9.3
• CVE-2025-2751A vulnerability has been found in Open Asset Import Library …8.8
• CVE-2025-27510conda-forge-metadata provides programatic access to conda-fo…9.3
• CVE-2025-27511GeoServer is an open source server that allows users to shar…7.2
• CVE-2025-27513OpenTelemetry dotnet is a dotnet telemetry framework. A vuln…7.5
• CVE-2025-27514GLPI is a Free Asset and IT Management Software package, Dat…5.4
• CVE-2025-27515Laravel is a web application framework. When using wildcard …9.8
• CVE-2025-27516Jinja is an extensible templating engine. Prior to 3.1.6, an…8.8
• CVE-2025-27517Volt is an elegantly crafted functional API for Livewire. Ma…9.3
• CVE-2025-27518Cognita is a RAG (Retrieval Augmented Generation) Framework …6.9