CVE-2026-23893

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication.

• CWE-59

• https://github.com/opencryptoki/opencryptoki/commit/5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45Patch
• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5qPatch, Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23888pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23889pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-2389The Complianz – GDPR/CCPA Cookie Consent plugin for WordPres…4.9
• CVE-2026-23890pnpm is a package manager. Prior to version 10.28.1, a path …6.5
• CVE-2026-23891Decidim is a participatory democracy framework. In versions …8.7
• CVE-2026-23892OctoPrint provides a web interface for controlling consumer …5.9
• CVE-2026-23896immich is a high performance self-hosted photo and video man…8.8
• CVE-2026-23897Apollo Server is an open-source, spec-compliant GraphQL serv…7.5
• CVE-2026-23898Lack of input validation leads to an arbitrary file deletion…7.2
• CVE-2026-23899An improper access check allows unauthorized access to webse…8.8
• CVE-2026-23900Various stored XSS vulnerabilities in the maps- and icon ren…6.5
• CVE-2026-23901Observable Timing Discrepancy vulnerability in Apache Shiro.…2.5