CVE-2026-23893
Opencryptoki Project Opencryptoki ≥ 2.3.2
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:LSummary
CVE-2026-23893 is a medium-severity Link Following (CWE-59) vulnerability in Opencryptoki Project Opencryptoki. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4203
Vulnerability Data
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesystem targets by planting symlinks in…
more
group-writable token directories, resulting in privilege escalation or data exposure. Token and lock directories are 0770 (group-writable for token users), so any token-group member can plant files and symlinks inside them. When run as root, the base code handling token directory file access, as well as several openCryptoki tools used for administrative purposes, may reset ownership or permissions on existing files inside the token directories. An attacker with token-group membership can exploit the system when an administrator runs a PKCS#11 application or administrative tool that performs chown on files inside the token directory during normal maintenance. This issue is fixed in commit 5e6e4b4, but has not been included in a released version at the time of publication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Symlink-following in group-writable token dirs when code/tools run as root directly enables local privilege escalation (CWE-59).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Running administrative tools with root privileges on group-writable token directories enables symlink-based redirection to arbitrary targets.
Restricts the ability of privileged processes to perform chown or other modifications on files inside shared token directories without validation.
Requires validation of file paths and rejection of untrusted symbolic links before performing privileged file operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code to validate paths and avoid unsafe link following.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect link-following flaws before release.
Secure SDLC practices can mandate link-resolution checks and canonicalization before file access.
Application security requirements can explicitly require safe handling of symbolic links and path traversal.
Secure architecture principles include input validation and safe file-access design patterns.
Secure coding standards directly address canonicalization and symlink attacks during implementation.
Access-control rules can limit which files are reachable, reducing exposure to malicious links.