CVE-2026-41651

🗓️ 22 Apr 2026 13:11:40Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 486 Views🌐 WEB

CVE-2026-41651 TOCTOU race in PackageKit lets unprivileged users install as root via flags.

Reporter	Title	Published	Views	Family All 197
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	3 May 202602:54	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	6 May 202606:12	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	25 Apr 202603:29	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	29 Apr 202615:40	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	24 Apr 202610:32	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	20 May 202607:26	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	25 Jul 202608:13	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	23 Apr 202609:58	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	13 Nov 202607:45	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	2 Aug 202610:57	–	githubexploit

NVD

Vulners

Node

packagekit_project packagekitRange1.0.2–1.3.5

[
  {
    "vendor": "PackageKit",
    "product": "PackageKit",
    "versions": [
      {
        "version": ">= 1.0.2, <= 1.3.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
github	www.github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
github	www.github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c
github	www.github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c
github	www.github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c
access	www.access.redhat.com/security/cve/CVE-2026-41651
access	www.access.redhat.com/errata/RHSA-2026:18031
access	www.access.redhat.com/errata/RHSA-2026:17560
access	www.access.redhat.com/errata/RHSA-2026:19354
access	www.access.redhat.com/errata/RHSA-2026:17558

Parameter	Position	Path	Description	CWE
url	request body	/api/validate	SSRF vulnerability in the URL validation form. The server fetches the provided URL, and the filter can be bypassed using shorthand IP addresses like '127.1' to access internal services.	CWE-918
format	request body	/api/validate	SSRF vulnerability in the URL validation form. The server fetches the provided URL, and the filter can be bypassed using shorthand IP addresses like '127.1' to access internal services.	CWE-918

11 Nov 2026 23:10Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.18.8

EPSS0.00546

SSVC

CWE-367