CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Published Feb 16, 2022 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Red Hat vulnerabilities
All Red Hat entriesCVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
high7.8ExploitedJan 28, 2022CVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
critical9.8ExploitedNov 6, 2018CVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability
critical9.8ExploitedOct 4, 2017CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
high7.8ExploitedDec 7, 2015CVE-2015-3246
Red Hat Libuser Race Condition Vulnerability
high7.4ExploitedAug 11, 2015CVE-2010-1871
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
high8.8ExploitedAug 5, 2010