CVE-2026-4948: 
NixOS vulnerability analysis and mitigation

CVE-2026-4948 is a missing/incorrect authorization vulnerability in firewalld that allows a local unprivileged user to modify the runtime firewall state without proper authentication. The flaw affects firewalld versions up to and including 2.4.0, as well as Red Hat Enterprise Linux 7.0 and later distributions shipping the affected package. It was disclosed on March 27, 2026, with patch details registered in Red Hat Bugzilla. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-279 (Incorrect Execution-Assigned Permissions) / CWE-862 (Missing Authorization). Specifically, firewalld mis-authorizes two runtime D-Bus setters — setZoneSettings2 and setPolicySettings — by guarding them with PK_ACTION_CONFIG_INFO instead of a more restrictive PolicyKit action. When the shipped desktop policy profile is active, this allows a local unprivileged user (requiring only low-privilege local access) to invoke these D-Bus methods and directly alter the runtime firewall configuration without authentication. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation allows a local unprivileged attacker to bypass D-Bus authorization checks and modify firewall runtime settings, including altering zone configurations and security policies. This can result in unauthorized firewall rule modifications, disabling of security policies, and creation of network pathways for malicious traffic — directly compromising the integrity of the system's network security posture. There is no confidentiality or availability impact; the primary risk is integrity loss of the firewall's runtime configuration, which could facilitate further attacks by enabling inbound or lateral network traffic that would otherwise be blocked (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.019% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local, unprivileged access to a system running firewalld with the desktop profile active, limiting the attack surface to multi-user or shared systems (Red Hat Advisory, Red Hat Bugzilla).

1. Reconnaissance: Confirm the target system is running firewalld version ≤ 2.4.0 with the desktop profile active (e.g., check /etc/firewalld/firewalld.conf for AllowZoneDrifting and active profile, or run firewall-cmd --state).
2. Identify D-Bus interface: Use busctl or gdbus to enumerate the firewalld D-Bus interface at org.fedoraproject.FirewallD1 and confirm the setZoneSettings2 and setPolicySettings methods are accessible.
3. Invoke mis-authorized setter: As a local unprivileged user, call the setZoneSettings2 or setPolicySettings D-Bus method without authentication, for example:

   gdbus call --system --dest org.fedoraproject.FirewallD1 \
     --object-path /org/fedoraproject/FirewallD1 \
     --method org.fedoraproject.FirewallD1.zone.setZoneSettings2 \
     "public" "<modified_settings>" false

4. Modify firewall state: Supply crafted zone or policy settings to open ports, disable rules, or alter network access controls in the runtime configuration — changes take effect immediately without requiring authentication or elevated privileges (Red Hat Bugzilla).

• Logs: Unexpected D-Bus method calls to org.fedoraproject.FirewallD1 for setZoneSettings2 or setPolicySettings originating from unprivileged user sessions in system logs (e.g., /var/log/messages, journalctl -u firewalld).
• Logs: firewalld audit log entries showing runtime zone or policy changes not initiated by root or an authorized administrator.
• Network: Unexpected open ports or altered firewall zones detected via firewall-cmd --list-all or network scanning tools that differ from the persistent (on-disk) configuration.
• Process: busctl, gdbus, or dbus-send processes invoked by non-root, non-admin users interacting with the firewalld D-Bus interface.

Patches are available for firewalld versions up to and including 2.4.0; administrators should update to the patched version provided by their distribution (e.g., via SUSE security update SUSE-SU-202621418-1, SUSE-SU-20261872-1, SUSE-SU-20262302-1, Amazon Linux 2023 ALAS2023-2026-1636, and Debian LTS). As a workaround, restrict local system access to trusted users and avoid using the firewalld desktop profile on multi-user systems. Monitor D-Bus activity for suspicious calls to setZoneSettings2 and setPolicySettings from unprivileged accounts (Red Hat Advisory, SUSE Advisory, Amazon Linux Advisory).

Multiple Linux distributions including SUSE, openSUSE, Amazon Linux 2023, and Debian have issued security advisories and updates addressing this vulnerability. Tenable published Nessus detection plugins (IDs 314978, 315054, 320000, 319981) for scanning affected systems. Coverage has been relatively low-key given the medium severity and local-only attack vector, with mentions in Linux security news outlets such as linuxsecurity.com and pro-linux.de (SUSE Advisory, Tenable Plugin).