Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
GNOME GLib — Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N N 7.5 .0048 39.5 —
AFFECTED
Product Versions Fixed
GLib unspecified —
Red Hat Enterprise Linux 10 unspecified 0:2.80.4-12.el10_2.21
Red Hat Enterprise Linux 8 unspecified 0:2.70.1-9.el8_10
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 9 unspecified 0:2.68.4-19.el9_8.9
Red Hat Enterprise Linux 10 unspecified —
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 9 unspecified —
+ 1 more
TIMELINE
Jun 26 Reserved by redhat
Jun 30 EXPLOIT PUBLISHED — CVE-2026-58015 (GNOME GLib). Public exploit reference added.
Jun 30 Published (CNA: redhat)
Aug 17 EXPLOIT PUBLISHED — CVE-2026-58015 (GNOME GLib). Public exploit reference added.
Aug 17 RESCORED — CVE-2026-58015 (GNOME GLib). CVSS 5.9 → 7.5 (NVD).
Description
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| June 26, 2026 | Reserved | Reserved by redhat |
| June 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58015 (GNOME GLib). Public exploit reference added. |
| June 30, 2026 | Published | Published (CNA: redhat) |
| August 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-58015 (GNOME GLib). Public exploit reference added. |
| August 17, 2026 | RESCORED | RESCORED — CVE-2026-58015 (GNOME GLib). CVSS 5.9 → 7.5 (NVD). |
Affected
Affected products and packages — 11 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| GNOME | GLib | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:2.80.4-12.el10_2.21 |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | 0:2.70.1-9.el8_10 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:2.68.4-19.el9_8.9 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | — |
| Red Hat | Red Hat Hardened Images | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-58015 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.