CVE-2026-109968

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

• CWE-532

• https://access.redhat.com/security/cve/CVE-2026-109968
• https://bugzilla.redhat.com/show_bug.cgi?id=2462394

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109962Froxlor 0.10.0 before 2.3.14 contains a missing authorizatio…4.3
• CVE-2026-109963Froxlor before 2.3.14 contains an insecure direct object ref…4.3
• CVE-2026-109964ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap bu…5.6
• CVE-2026-109965Serena before 2.0.0 contains an improper link resolution vul…7.1
• CVE-2026-109966yt-dlp-web-ui through 4.0.0 contains an argument injection v…5.3
• CVE-2026-109967yt-dlp-web-ui through 4.0.0 contains a NULL pointer derefere…7.5
• CVE-2026-109969A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs1…4.7
• CVE-2026-10997Insufficient policy enforcement in Extensions in Google Chro…6.5
• CVE-2026-109970A flaw was found in the clevis PKCS#11 pin. The clevis-luks-…4.7
• CVE-2026-109971A flaw was found in the clevis PKCS#11 pin. The clevis-decry…4.7
• CVE-2026-109976A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs1…4.7
• CVE-2026-10998Out of bounds read in Media in Google Chrome prior to 149.0.…4