CVE-2026-4948

A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations.

This vulnerability is rated as Moderate impact because exploitation is restricted to local unprivileged users and requires an active desktop PolicyKit configuration to alter runtime firewall rules. Standard server environments remain largely unaffected unless configured with desktop authorization profiles that relax permissions for active local sessions. While an attacker can tamper with active packet filtering policies without administrative credentials, the flaw does not facilitate direct privilege escalation or permanent configuration changes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the firewalld desktop policy is not active on systems where local unprivileged user access is a concern. If firewalld is not required, it can be disabled. Disabling firewalld may impact network services that rely on it.

To disable firewalld: sudo systemctl stop firewalld sudo systemctl disable firewalld

A system restart or service reload may be required for changes to take full effect.