Back to CVE Browser

CVE-2021-3560

🔥 Known Exploited (CISA KEV)HIGH

7.8

CVSS Severity Score

EPSS Score42.5550%

EPSS Percentile98.95th

Published2022-02-16

Last Modified2026-06-17

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected Platforms (CPE)

📦

Polkit Project

Polkit

< 0.119

💻

Debian

Debian Linux

= 11.0

💻

Canonical

Ubuntu Linux

= 20.04

📦

Redhat

Virtualization

= 4.0

References & Advisories

🔗 http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html

🔗 http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=1961710

🔗 https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/

🔗 http://packetstormsecurity.com/files/172836/polkit-Authentication-Bypass.html

🔗 http://packetstormsecurity.com/files/172846/Facebook-Fizz-Denial-Of-Service.html

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=1961710

🔗 https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/

Related Vulnerabilities

CVE-2026-410487.1

Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to ...

CVE-2026-410458.1

A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers...

CVE-2025-60187.8

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (...

CVE-2025-75196.7

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be ...