CVE-2026-58015: Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• gnome glibbefore 2.88.1
• redhat enterprise linux10.0
• redhat enterprise linux6.0
• redhat enterprise linux7.0
• redhat enterprise linux8.0
• redhat enterprise linux9.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• GNOME GLib

  • before 2.88.1affected · semver

• Red Hat Cert Manager support for Red Hat OpenShift release 1.17

  • 1791371080 and laternot affected · rpm
  • 1791371069 and laternot affected · rpm
  • 1791788287 and laternot affected · rpm
  • 1791378395 and laternot affected · rpm
  • 1791970484 and laternot affected · rpm

• Red Hat Cert Manager support for Red Hat OpenShift release 1.18

  • 1791459707 and laternot affected · rpm
  • 1791459711 and laternot affected · rpm
  • 1791459759 and laternot affected · rpm
  • 1789029076 and laternot affected · rpm
  • 1791966259 and laternot affected · rpm

• Red Hat Cert Manager support for Red Hat OpenShift release 1.19

  • 1788348522 and laternot affected · rpm
  • 1788348571 and laternot affected · rpm
  • 1788348571 and laternot affected · rpm
  • 1788348594 and laternot affected · rpm

• Red Hat Cert Manager support for Red Hat OpenShift release 1.20

  • 1790223279 and laternot affected · rpm
  • 1790223719 and laternot affected · rpm
  • 1790272426 and laternot affected · rpm
  • 1790589998 and laternot affected · rpm
  • 1790589912 and laternot affected · rpm
  • 1790589914 and laternot affected · rpm
  • 1790589855 and laternot affected · rpm
  • 1790598593 and laternot affected · rpm

• Red Hat Red Hat AI Inference Server 3.2

  • 1790621714 and laternot affected · rpm
  • 1790621718 and laternot affected · rpm
  • 1790621713 and laternot affected · rpm

• Red Hat Red Hat AI Inference Server 3.5

  • 1791425869 and laternot affected · rpm
  • 1791427182 and laternot affected · rpm
  • 1791803821 and laternot affected · rpm
  • 1791473631 and laternot affected · rpm
  • 1791818357 and laternot affected · rpm
  • 1791473614 and laternot affected · rpm

• Red Hat Red Hat Discovery 2

  • 1788205779 and laternot affected · rpm
  • 1788206196 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10

  • 0:2.80.4-12.el10_2.21 and laternot affected · rpm
  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:2.80.4-4.el10_0.17 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6

  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:2.56.1-13.el7_9.1 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-12450file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is
  40Plan
• CVE-2018-16428In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.
  40Plan
• CVE-2025-14087Glib: glib: buffer underflow in gvariant parser leads to heap corruption
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-58013Jun 30, 2026 · Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
  32Monitor
• ← EarlierCVE-2026-58014Jun 30, 2026 · Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
  34Monitor
• Later →CVE-2026-58016Jun 30, 2026 · Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
  36Monitor

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.