PatchSiren cyber security CVE debrief
CVE-2026-12080 Red Hat CVE debrief
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- CVSS
- HIGH 7.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
System administrators and security teams responsible for managing QEMU Guest Agent installations, particularly in environments where local unprivileged users may pose a threat. They should assess their exposure, review vendor guidance, and apply necessary patches or updates to mitigate the vulnerability. Additionally, they should monitor systems for suspicious activity related to symbolic link manipulation and consider implementing additional security controls.
Technical summary
The vulnerability is located in the guest-ssh-add-authorized-keys command handler of QEMU Guest Agent. An attacker can exploit this by creating symbolic links to manipulate file ownership, potentially leading to root access. The attack requires local access and an external management layer like libvirt to trigger the vulnerable code path. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories. This vulnerability can be mitigated by applying patches or updates provided by the QEMU project or relevant Linux distributions, restricting access to the QEMU Guest Agent, and monitoring systems for suspicious activity.
Defensive priority
High priority due to potential for local privilege escalation.
Recommended defensive actions
- Immediately apply patches or updates provided by the QEMU project or relevant Linux distributions.
- Restrict access to the QEMU Guest Agent to only necessary users and services.
- Monitor systems for suspicious activity related to symbolic link manipulation.
- Consider implementing additional security controls, such as SELinux or AppArmor, to limit the impact of potential exploits.
- Regularly review and update system configurations to ensure they align with security best practices.
Evidence notes
The CVE record was published on 2026-07-20T13:16:55.543Z and was last modified on 2026-07-21T18:31:51.680Z. The NVD entry is currently Awaiting Analysis. References include Red Hat security advisories and QEMU project work items.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T13:16:55.543Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.