CVE-2026-44943
- Source
- https://cve.org/CVERecord?id=CVE-2026-44943
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44943.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-44943
- Downstream
- Related
- Published
- 2026-07-29T12:58:49.817Z
- Modified
- 2026-08-01T08:23:04.779260Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- remote limited file-write as root via discovery in open-iscsi
- Details
-
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.
This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44943.json", "cna_assigner": "suse", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "?" }, { "last_affected": "668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e" } ] }, { "source": "DESCRIPTION", "extracted_events": [ { "fixed": "668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e" } ] } ] }- References
Affected packages
Git / github.com/open-iscsi/open-iscsi
Affected versions
2.*
2.0.873
2.0.874
2.0.875
2.0.876
2.0.877
2.0.878
2.1.0
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.9
Database specific
vanir_signatures_modified
"2026-08-01T08:23:04Z"
vanir_signatures
[
{
"signature_type": "Function",
"target": {
"file": "usr/discovery.c",
"function": "discovery_isns_query"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-06e501de",
"signature_version": "v1",
"digest": {
"function_hash": "234155107440779935736282635754067279335",
"length": 3112.0
}
},
{
"signature_type": "Function",
"target": {
"file": "usr/discovery.c",
"function": "discovery_isns_reg_node"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-0adb06da",
"signature_version": "v1",
"digest": {
"function_hash": "218722674135731319498316465810666013820",
"length": 1147.0
}
},
{
"signature_type": "Line",
"target": {
"file": "usr/iscsistart.c"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-20acbeac",
"signature_version": "v1",
"digest": {
"line_hashes": [
"14722739685535177145227048387826414302",
"69242526050992702030608613110327143491",
"322589338340157935634494497697342682411",
"144192728533476265023125276780510452496"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "usr/iscsistart.c",
"function": "main"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-3acb7305",
"signature_version": "v1",
"digest": {
"function_hash": "120361746734299385514916582863098774959",
"length": 4705.0
}
},
{
"signature_type": "Function",
"target": {
"file": "usr/iscsiadm.c",
"function": "exec_disc_op_on_recs"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-3da7aa17",
"signature_version": "v1",
"digest": {
"function_hash": "261087157498683897136877044555651405124",
"length": 963.0
}
},
{
"signature_type": "Line",
"target": {
"file": "iscsiuio/src/unix/iscsid_ipc.c"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-5b864040",
"signature_version": "v1",
"digest": {
"line_hashes": [
"59158746369333330547871875733174744805",
"296100887643099557226250545686499014771",
"240300800138313144191902787072051334758",
"150543996205726448559114558726487048063",
"154773265534532623166005655151971677249",
"83337467462007182181924272134438485432",
"138667331354269941743567863763741597745"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "usr/initiator.h"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-747acb4c",
"signature_version": "v1",
"digest": {
"line_hashes": [
"82397512541519343514368775161759770372",
"66333901412556814279069007839504320573",
"251405028637901866450288246246362208849",
"292116255081475621265361682481547440432"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "iscsiuio/src/unix/iscsid_ipc.c",
"function": "iscsid_loop"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-830752f8",
"signature_version": "v1",
"digest": {
"function_hash": "210677901587003948915603983630160819111",
"length": 1125.0
}
},
{
"signature_type": "Line",
"target": {
"file": "usr/iscsiadm.c"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-857ab1d9",
"signature_version": "v1",
"digest": {
"line_hashes": [
"7237487927917169663176282050099825850",
"20741529215795224615051636605188726549",
"59439018414944335544581565376794056567",
"9152805459615786884311836284498256530"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "usr/discovery.c",
"function": "add_target_record"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-ba1aefb5",
"signature_version": "v1",
"digest": {
"function_hash": "87968220264877939529941293760451822798",
"length": 1599.0
}
},
{
"signature_type": "Line",
"target": {
"file": "usr/discovery.c"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-be5ac0c9",
"signature_version": "v1",
"digest": {
"line_hashes": [
"335584415041921091737298524604908997120",
"105279378104460838901831576701193152611",
"105857790044612101199936671500635754325",
"43432125830909746330283552467153672575",
"174706434573723572822427255013325900755",
"72662564552827018822351897189697216199",
"210867617079644248891360496077910082360",
"284766815751440630424479232743657563869",
"45984452319758561090106512972612744686",
"124898477295598043698973202468370699000",
"238999011614284875811538488073870326080",
"67925512873573470896495790544078741858",
"34476021854864360663593129651033717421",
"135810147794008738843191704155480849714"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"target": {
"file": "usr/initiator_common.c"
},
"deprecated": false,
"source": "https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e",
"id": "CVE-2026-44943-fad07016",
"signature_version": "v1",
"digest": {
"line_hashes": [
"240766703168005188945468331196914646145",
"304938971671869896450974934501387742534",
"106438839204855802403035916179644233410",
"230405382682465619740373895979501185814",
"101368393474163512253845269023945559967"
],
"threshold": 0.9
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44943.json"