debian/clevis vulnerabilities

Latest debian/clevis CVEs

Newest publication first

1. CVE-2026-109968 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

   Published 2026-10-14

   Medium·CVSS 5.5 EPSS 0.08%

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local a...

2. CVE-2026-109971 Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

   Published 2026-10-14

   Medium·CVSS 4.7 EPSS 0.15%

   A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

3. CVE-2026-109970 Clevis: clevis: pkcs#11 token pin written to world-readable file

   Published 2026-10-14

   Medium·CVSS 4.7 EPSS 0.12%

   A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cl...

4. CVE-2026-109969 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

   Published 2026-10-14

   Medium·CVSS 4.7 EPSS 0.13%

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and injec...

5. CVE-2026-109976 Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection

   Published 2026-10-13

   Medium·CVSS 4.7 EPSS 0.14%

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.