{"id":"CVE-2026-44944","summary":"iscsiuio control-socket authentication bypass in open-iscsi","details":"An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.\n\n\n\n\n\n\nThis issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","modified":"2026-08-27T18:26:07.521201841Z","published":"2026-07-29T13:04:50.575Z","related":["ALSA-2026:53844","ALSA-2026:53845","SUSE-SU-2026:23157-1","SUSE-SU-2026:23223-1","SUSE-SU-2026:23235-1","SUSE-SU-2026:3647-1","openSUSE-SU-2026:21580-1"],"database_specific":{"cna_assigner":"suse","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44944.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"?"},{"last_affected":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}]},{"source":"DESCRIPTION","extracted_events":[{"fixed":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44944.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44944"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44944"},{"type":"FIX","url":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-iscsi/open-iscsi","events":[{"introduced":"0"},{"fixed":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2.1.11","2.1.10","2.1.9","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.0","2.0.878","2.0.877","2.0.876","2.0.875","2.0.874","2.0.873"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:24:33Z","vanir_signatures":[{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"function":"discovery_isns_query","file":"usr/discovery.c"},"deprecated":false,"digest":{"function_hash":"234155107440779935736282635754067279335","length":3112},"id":"CVE-2026-44944-06e501de","signature_type":"Function","signature_version":"v1"},{"target":{"function":"discovery_isns_reg_node","file":"usr/discovery.c"},"deprecated":false,"digest":{"length":1147,"function_hash":"218722674135731319498316465810666013820"},"id":"CVE-2026-44944-0adb06da","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"},{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsistart.c"},"deprecated":false,"digest":{"line_hashes":["14722739685535177145227048387826414302","69242526050992702030608613110327143491","322589338340157935634494497697342682411","144192728533476265023125276780510452496"],"threshold":0.9},"id":"CVE-2026-44944-20acbeac","signature_type":"Line","signature_version":"v1"},{"target":{"file":"usr/iscsistart.c","function":"main"},"deprecated":false,"digest":{"length":4705,"function_hash":"120361746734299385514916582863098774959"},"id":"CVE-2026-44944-3acb7305","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsiadm.c","function":"exec_disc_op_on_recs"},"deprecated":false,"digest":{"function_hash":"261087157498683897136877044555651405124","length":963},"id":"CVE-2026-44944-3da7aa17"},{"digest":{"threshold":0.9,"line_hashes":["59158746369333330547871875733174744805","296100887643099557226250545686499014771","240300800138313144191902787072051334758","150543996205726448559114558726487048063","154773265534532623166005655151971677249","83337467462007182181924272134438485432","138667331354269941743567863763741597745"]},"id":"CVE-2026-44944-5b864040","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"iscsiuio/src/unix/iscsid_ipc.c"},"deprecated":false},{"digest":{"line_hashes":["82397512541519343514368775161759770372","66333901412556814279069007839504320573","251405028637901866450288246246362208849","292116255081475621265361682481547440432"],"threshold":0.9},"id":"CVE-2026-44944-747acb4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/initiator.h"},"deprecated":false},{"digest":{"function_hash":"210677901587003948915603983630160819111","length":1125},"id":"CVE-2026-44944-830752f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"function":"iscsid_loop","file":"iscsiuio/src/unix/iscsid_ipc.c"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["7237487927917169663176282050099825850","20741529215795224615051636605188726549","59439018414944335544581565376794056567","9152805459615786884311836284498256530"]},"id":"CVE-2026-44944-857ab1d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsiadm.c"},"deprecated":false},{"target":{"file":"usr/discovery.c","function":"add_target_record"},"deprecated":false,"digest":{"length":1599,"function_hash":"87968220264877939529941293760451822798"},"id":"CVE-2026-44944-ba1aefb5","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"},{"id":"CVE-2026-44944-be5ac0c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/discovery.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335584415041921091737298524604908997120","105279378104460838901831576701193152611","105857790044612101199936671500635754325","43432125830909746330283552467153672575","174706434573723572822427255013325900755","72662564552827018822351897189697216199","210867617079644248891360496077910082360","284766815751440630424479232743657563869","45984452319758561090106512972612744686","124898477295598043698973202468370699000","238999011614284875811538488073870326080","67925512873573470896495790544078741858","34476021854864360663593129651033717421","135810147794008738843191704155480849714"]}},{"digest":{"threshold":0.9,"line_hashes":["240766703168005188945468331196914646145","304938971671869896450974934501387742534","106438839204855802403035916179644233410","230405382682465619740373895979501185814","101368393474163512253845269023945559967"]},"id":"CVE-2026-44944-fad07016","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/initiator_common.c"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44944.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}