PT-2026-3885 · Unknown · Opencryptoki

Pavelkohout396 · Published 2026-01-22 · Updated 2026-02-20 · CVE-2026-23893

Positive Technologies · (AI Summary)

CVSS v3.1

6.8

6.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions openCryptoki versions 2.3.2 and above

Description openCryptoki is a PKCS#11 library used on Linux and AIX systems. Versions 2.3.2 and above are susceptible to symlink-following when operating in privileged contexts. A user belonging to the token-group can redirect file operations to arbitrary filesystem locations by creating symlinks within group-writable token directories, potentially leading to privilege escalation or data exposure. The token and lock directories are configured with 0770 permissions, allowing any token-group member to place files and symlinks inside them. When executed with root privileges, the base code responsible for handling token directory file access, along with several openCryptoki tools used for administrative tasks, may modify the ownership or permissions of existing files within these token directories. An attacker with token-group membership can exploit this issue when an administrator runs a PKCS#11 application or administrative tool that performs

chown

operations on files inside the token directory during routine maintenance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-23893

GHSA-J6C7-MVPX-JX5Q

OESA-2026-1257

OESA-2026-1258

OESA-2026-1320

OESA-2026-1321

SUSE-SU-2026:0481-1

Affected Products

Opencryptoki

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23893.json · Exploit
• https://osv.dev/vulnerability/OESA-2026-1258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23893 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1320 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23893 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22791 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0481-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23893 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1321 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23893 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23893 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23893 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23893 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1257 · Vendor Advisory
• https://github.com/opencryptoki/opencryptoki/security/advisories/GHSA-j6c7-mvpx-jx5q · Note