CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot Privilege Escalation Vulnerability in PackageKit TOCTOU Race Condition 📌 Overview CVE-2026-41651 is a local privilege escalation vulnerability affecting the PackageKit system service used in various Linux distributions. The vulnerability is caused by a Time-of-Chec...

CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 TOCTOU race in PackageKit's transaction handler. Any local unprivileged user can install arbitrary packages as root with no authentication. Overview Field| Value ---|--- CVE| CVE-2026-41651 Component| PackageKit daemon packagekitd Affected versions| 1.0.2 – 1.3.4 Fix...

POC

POC For research purposes only! A public collection of POCs & Exploits for the vulnerabilities I discovered. CVE-2022-22583 PackageKit : An application may be able to access restricted files SIP Bypass CVE-2022-26690 PackageKit : A malicious application may be able to modify protected parts of th...

cohort-htb

Cohort — HTB writeup & exploit chain Machine Cohort HackTheBox. Full kill chain: 1. SSRF in the Flask API /api/validate → internal vhost discovery 2. Pre-auth RCE in Marimo 0.20.4 WebSocket terminal CVE-2026-39987 → shell as marimo 3. Privilege escalation via PackageKit 1.2.8 D-Bus TOCTOU...

cve-2026-28912

CVE-2026-28912 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS PackageKit symlink-following bug CVE-2026-28912, plus a working PoC that demonstrates the installer writing an attacker-controlled file as root through a directory symlink in the install...

CVE-2026-41651-analysis

CVE-2026-41651 — Pack2TheRoot Analysis PackageKit Local Privilege Escalation TOCTOU Race Condition CVSS v3.1: 8.8 HIGH | CWE-367 | Published: 2026-04-22 📌 Overview This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability...

pack2theroot-lab

Pack2TheRoot Lab — CVE-2026-41651 Лаборатория локального повышения привилегий в стиле CTF на базе Docker, построенная вокруг Pack2TheRoot advisory CVE-2026-41651 — 12-летней уязвимости в демоне PackageKit, раскрытой Red Team компании Deutsche Telekom 22 апреля 2026 года. Лаборатория включает три...

CVE-2026-41651

CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Classification: Purple Team Assessment Artifact Authorized use only. This document and the accompanying test script are intended solely for internal security validation on systems where written authorization has been obtained. Proof of...

Rocky Linux 9.6 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.6:CLSA-2026:1778773906)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778773906 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architectur...

Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1340)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261340 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...

Rocky Linux 9.2 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1515)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261515 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...

Rocky Linux 9.4 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-doc / cockpit-packagekit / etc (ciqsa-2026_1332)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261332 advisory. This advisory aggregates security fixes for the cockpit SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2026-4631. Tenable has extracted the preceding description...

Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1516)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261516 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2024-0217. Tenable has extracted the preceding description...

Rocky Linux 9.6 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-doc / cockpit-packagekit / etc (ciqsa-2026_1333)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261333 advisory. This advisory aggregates security fixes for the cockpit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-4631. Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19354)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619354 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19141)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619141 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_11635)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202611635 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_11504)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202611504 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 9.2 [CIQ] Security Update: cockpit / cockpit-bridge / cockpit-doc / cockpit-packagekit / etc (ciqsa-2026_1331)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261331 advisory. This advisory aggregates security fixes for the cockpit SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-4631. Tenable has extracted the preceding description...

AlmaLinux 9.6 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.6:CLSA-2026:1778773906)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778773906 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture...