Security Advisory catalog CVE-2026-19816
cve-program · CVE-2026-19816 Published
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-19816 Published PackageKit https://github.com/PackageKit/PackageKit
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"packageName": "PackageKit",
"collectionURL": "https://github.com/PackageKit/PackageKit",
"defaultStatus": "unaffected",
"modules": [
"dnf5 backend"
],
"programFiles": [
"backends/dnf5/dnf5-backend-thread.cpp",
"src/pk-transaction.c"
],
"versions": [
{
"version": "1.3.4",
"lessThan": "1.4.0",
"versionType": "semver",
"status": "affected"
}
]
} PackageKit https://bodhi.fedoraproject.org/updates/?packages=PackageKit
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Fedora",
"product": "Fedora",
"packageName": "PackageKit",
"collectionURL": "https://bodhi.fedoraproject.org/updates/?packages=PackageKit",
"defaultStatus": "unaffected",
"modules": [
"dnf5 backend"
],
"versions": [
{
"version": "1.3.4",
"lessThan": "1.4.0",
"versionType": "semver",
"status": "affected"
}
]
} PackageKit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "PackageKit",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
} PackageKit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"packageName": "PackageKit",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
} PackageKit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "PackageKit",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
} PackageKit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "PackageKit",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
} compat-PackageKit08 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "compat-PackageKit08",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
} PackageKit https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "PackageKit",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
} Original source record · Cite this exact observation · Complete original publisher JSON