CVE-2026-44943: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-44943 is a path traversal vulnerability (CWE-22) in open-iscsi that allows remote man-in-the-middle (MITM) attackers to create root-owned files outside the designated database directory and inject arbitrary lines into existing records. The vulnerability was discovered by Keith at Linneman Labs and publicly disclosed on July 29, 2026. It affects all open-iscsi versions up to and including commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e. The CVSS v3.1 base score is 8.6 (High), while the CVSS v4.0 base score is 6.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is insufficient validation of IQN (iSCSI Qualified Name) target names received during iSCSI discovery. Open-iscsi uses target names as directory names within its database directory (typically /var/lib/iscsi), and prior to the fix, it accepted names containing path traversal sequences such as ../../../* without sanitization (open-iscsi commit). A MITM attacker positioned between the iSCSI initiator and a discovery server (e.g., iSNS or SendTargets) can craft a malicious target name containing directory traversal characters (forward slashes, etc.) that are prohibited by RFC 3722 Section 6.2 but were not previously enforced. The fix introduces an iqn_name_valid() function that rejects names containing characters outside the RFC 3722-permitted ASCII set, applied across discovery.c, iscsiadm.c, and iscsistart.c (open-iscsi commit).

A successful exploit allows a remote MITM attacker to write root-owned files to arbitrary locations on the filesystem and inject arbitrary content into existing records, posing a significant integrity risk. This could be leveraged to overwrite sensitive system files (e.g., /etc/cron.d/, /etc/sudoers.d/), potentially enabling privilege escalation or persistent access on the affected host. Confidentiality and availability are not directly impacted, but the ability to write root-owned files outside the iSCSI database directory makes this a serious integrity threat in storage-heavy environments (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Github Advisory). Exploitation requires a network-adjacent MITM position on the iSCSI discovery traffic, which limits opportunistic exploitation but is feasible in environments with unencrypted iSCSI networks. The EPSS score is approximately 0.33% (26th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify target systems running open-iscsi (versions up to commit 668ca1df) that perform iSCSI discovery (SendTargets or iSNS) over an unencrypted network segment.
2. Establish MITM position: Position between the iSCSI initiator and the discovery server (e.g., iSNS server or iSCSI target) using ARP spoofing, rogue DHCP, or other network interception techniques.
3. Intercept discovery response: Capture the iSCSI discovery response (SendTargets or iSNS query response) sent from the server to the initiator.
4. Craft malicious target name: Modify the TargetName field in the discovery response to include a path traversal sequence, e.g., iqn.2026-01.com.attacker:../../../etc/cron.d/backdoor, exploiting the lack of RFC 3722 character validation.
5. Inject response: Forward the tampered discovery response to the iSCSI initiator.
6. Trigger file creation: The open-iscsi daemon processes the malicious target name and creates a root-owned directory or file at the traversed path (e.g., /etc/cron.d/backdoor), or injects attacker-controlled content into an existing record, potentially enabling privilege escalation or persistence (open-iscsi commit, Github Advisory).

• File System: Unexpected root-owned files or directories created outside /var/lib/iscsi/, particularly in sensitive locations such as /etc/cron.d/, /etc/sudoers.d/, or other system directories; anomalous modification timestamps on files in these directories.
• Logs: Entries in /var/log/iscsid.log or syslog showing discovery of target names containing path traversal characters (e.g., ../, ..\); after patching, log messages such as Discovery TargetName invalid, ignoring or iSNS discovery Target Name invalid: ignoring it may indicate attempted exploitation.
• Network: Unexpected or duplicate iSCSI discovery responses on the network; ARP table anomalies suggesting MITM activity on the iSCSI network segment; iSCSI traffic (TCP port 3260) from unexpected source IPs.

The fix is included in open-iscsi at commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e and later. Red Hat has issued patches for affected distributions: RHSA-2026:53844 for Red Hat Enterprise Linux 9 and RHSA-2026:53845 for Red Hat Enterprise Linux 10 (Red Hat Bugzilla). Microsoft has also addressed the vulnerability in the Azure Linux 3 iscsi-initiator-utils package. As a workaround, implement network segmentation and encryption (e.g., IPsec) for iSCSI traffic to prevent MITM interception, and monitor the iSCSI database directory for unexpected file creation outside /var/lib/iscsi/.

SUSE issued a security announcement for the vulnerability via their openSUSE security mailing list, and Red Hat addressed it through two errata advisories (RHSA-2026:53844 and RHSA-2026:53845). Coverage has been limited to vendor advisories and security aggregator sites, with no notable independent researcher commentary or significant social media discussion observed at this time (Red Hat Bugzilla).