CVE-2026-44943

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle (MITM) attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This could lead to unauthorized system modification or privilege escalation.

This is an Important vulnerability in the open-iscsi iscsi-initiator-utils package, enabling remote Man-in-the-Middle (MITM) attackers to achieve privilege escalation. The path traversal flaw allows creating root-owned files and injecting malicious data into system records, posing a significant risk of unauthorized system modification without requiring user interaction or prior authentication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to iSCSI initiator systems to only trusted networks and hosts. If iSCSI is not actively used, consider disabling the iscsid service to prevent potential exploitation.

To disable the iscsid service: systemctl stop iscsid systemctl disable iscsid

*Note that disabling the iSCSI service will prevent the system from connecting to iSCSI targets and may impact functionality.