Critical Pack2TheRoot Vulnerability Exposes Linux Systems to Local Privilege Escalation

github.security.telekom.com

Critical Pack2TheRoot Vulnerability Exposes Linux Systems to Local Privilege Escalation

First seen 24 Apr 2026, 18:01 UTC • •70.5

Article Content

1 / 7

Browse articles

ThreatCluster •April 25, 2026 at 17:45 UTC

•CVE-2026-41651 allows local users to gain root access via PackageKit.
•The vulnerability affects all PackageKit versions from 1.0.2 to 1.3.4.
•Users should upgrade to PackageKit version 1.3.5 to mitigate the risk.

A high-severity vulnerability identified as CVE-2026-41651 affects the PackageKit daemon, allowing local unprivileged users to gain root access on Linux systems. Discovered by Deutsche Telekom's Red Team, the flaw enables unauthorized installation and removal of system packages. The vulnerability has existed for nearly 12 years, affecting all PackageKit versions from 1.0.2 to 1.3.4. A patch was released in version 1.3.5, but many distributions are still vulnerable. The exploit can be triggered by executing commands like 'pkcon install' without authentication under certain conditions. Although no active exploitation has been confirmed, the vulnerability leaves observable traces in system logs. Users are urged to upgrade to the patched version immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 168d ago How this analysis works

Timeline

2026-04-08

Deutsche Telekom Red Team reported vulnerability to maintainers.

2026-04-22

CVE-2026-41651 published.

2026-04-24

First public proof-of-concept released.

More articles in this cluster (6)

Threat Graph

12 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Privilege Escalation
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Organization (3)

Deutsche Telekom
Red Hat
Fedora

Vulnerability (2)

CVE-2026-41651
Pack2TheRoot

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (2)

Linux
PackageKit

Tool (1)

Claude Opus AI

Relationships

Claude Opus AI exploits CVE-2026-41651
Claude Opus AI exploits Pack2TheRoot
CVE-2026-41651 targets Linux
CVE-2026-41651 targets PackageKit
Pack2TheRoot targets Linux
Pack2TheRoot targets PackageKit
Privilege Escalation targets Linux
Privilege Escalation targets PackageKit
Zero-day Exploit targets Linux
Zero-day Exploit targets PackageKit
T1068 - Exploitation for Privilege Escalation targets Linux
T1068 - Exploitation for Privilege Escalation targets PackageKit
CVE-2026-41651 related to Deutsche Telekom
CVE-2026-41651 related to Red Hat
CVE-2026-41651 related to Fedora
CVE-2026-41651 related to CWE-269 - Improper Privilege Management

Following this threat?

Track Deutsche Telekom and CVE-2026-41651 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…