Critical Vulnerabilities in open-iscsi Affecting SUSE and openSUSE Systems

SUSE has released an important update for open-iscsi to address two critical vulnerabilities, CVE-2026-44943 and CVE-2026-44944, both published on 2026-07-29. CVE-2026-44943 allows remote MITM attackers to create root-owned files outside the database due to improper pathname limitations. CVE-2026-44944 permits unprivileged local users to access the `isscsiuio` control socket due to incorrect authorization. The vulnerabilities affect systems running open-iscsi version 2.1.12.suse+0.8f77cf16. Users are advised to audit Linux privileges to limit potential compromises. The update is critical for maintaining system integrity and security. The vulnerabilities were discovered by Keith at Linneman Labs, highlighting the importance of timely updates.

Key Points: • Two critical vulnerabilities in open-iscsi affect SUSE and openSUSE systems. • CVE-2026-44943 allows remote attackers to create unauthorized root-owned files. • CVE-2026-44944 enables local users to exploit control socket access improperly.