CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 Carrera TOCTOU en el manejador de transacciones de PackageKit. Cualquier usuario local sin privilegios puede instalar paquetes arbitrarios como root sin autenticación. Resumen Campo| Valor ---|--- CVE| CVE-2026-41651 Componente| Demonio de PackageKit packagekitd...

POC

POC For research purposes only! A public collection of POCs & Exploits for the vulnerabilities I discovered. CVE-2022-22583 PackageKit : An application may be able to access restricted files SIP Bypass CVE-2022-26690 PackageKit : A malicious application may be able to modify protected parts of th...

CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot PackageKit 中的权限提升漏洞（TOCTOU 竞态条件） 📌 概述 CVE-2026-41651 是一个影响多种 Linux 发行版中 PackageKit 系统服务的本地权限提升漏洞。 该漏洞由 检查时间到使用时间（TOCTOU）竞态条件 引起，可被滥用以操纵软件包安装流程并将权限提升至 root。 ⚠️ 影响 若成功利用，该漏洞可能允许本地非特权用户： 获得 root 级权限 执行 任意软件包安装脚本（RPM scriptlets） 修改系统级配置 破坏系统完整性与机密性 🧠 注意：该漏洞需要本地访问...

cohort-htb

Cohort — writeup de HTB y cadena de explotación Máquina Cohort HackTheBox. Cadena de ataque completa: 1. SSRF en la API Flask /api/validate → descubrimiento de vhost interno 2. RCE pre-auth en el terminal WebSocket de Marimo 0.20.4 CVE-2026-39987 → shell como marimo 3. Escalada de privilegios...

cve-2026-28912

CVE-2026-28912 — Notas de ingeniería inversa y reproducción Ingeniería inversa independiente del bug de seguimiento de enlaces simbólicos de macOS PackageKit CVE-2026-28912, además de un PoC funcional que demuestra que el instalador escribe un archivo controlado por el atacante como root a través...

CVE-2026-41651-analysis

CVE-2026-41651 — Análisis de Pack2TheRoot Escalada de privilegios local en PackageKit Condición de carrera TOCTOU CVSS v3.1: 8.8 ALTA | CWE-367 | Publicado: 2026-04-22 📌 Resumen Este repositorio recopila un informe de análisis personal y material de investigación sobre la vulnerabilidad de escala...

pack2theroot-lab

Pack2TheRoot Lab — CVE-2026-41651 Un laboratorio de escalada de privilegios local estilo CTF, dockerizado y construido en torno al aviso Pack2TheRoot CVE-2026-41651, una vulnerabilidad de 12 años en el demonio PackageKit divulgada por el Red Team de Deutsche Telekom el 22 de abril de 2026. El...

CVE-2026-41651

CVE-2026-41651 — Escalada de Privilegios Local TOCTOU en PackageKit Clasificación: Artefacto de Evaluación de Purple Team Solo uso autorizado. Este documento y el script de prueba adjunto están destinados exclusivamente a la validación de seguridad interna en sistemas donde se haya obtenido...

Rocky Linux 9.6 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.6:CLSA-2026:1778773906)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778773906 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architectur...

Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1340)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261340 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...

Rocky Linux 9.2 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1515)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261515 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2026-41651. Tenable has extracted the preceding descriptio...

Rocky Linux 10.2 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19141)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619141 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_11635)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202611635 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_19354)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619354 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

Rocky Linux 9.6 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-glib / etc (ciqsa-2026_1516)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261516 advisory. This advisory aggregates security fixes for the PackageKit SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2024-0217. Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: PackageKit / PackageKit-command-not-found / etc (crlsa-2026_11504)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202611504 advisory. PackageKit: race condition vulnerability leads to arbitrary package installation as root CVE-2026-41651 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.6:CLSA-2026:1778773906)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778773906 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture...

AlmaLinux 9.2 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.2:CLSA-2026:1779711412)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779711412 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture...

CVE-2026-41651

CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 Escalada local de privilegios mediante una condición de carrera TOCTOU en el manejador de transacciones D-Bus de PackageKit. Cualquier usuario local sin privilegio...

CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Pack2TheRoot Local Privilege Escalation exploit targeting the PackageKit daemon. Escalates from an unprivileged local user to root through a TOCTOU race condition vulnerability. 📌 Overview CVE-2026-41651 also known as Pack2TheRoot is...