The vulnerability — as verified Verification closed {{ verifiedAt }}

Severity — assessed

Actively exploited

Affected products

{{ inputProducts }}

{{ nt.text }}

The report — as submitted Received 2026-09-04 09:12 · public disclosure form

Severity — reporter's claim

Critical

Reporter

J. Vetter

External researcher · 3 prior reports

Title — as written by the reporter

“CRITICAL!!! full root on your agent, please respond fast”

Description

The Kunnus Agent's local IPC socket at /var/run/kunnus-agent.sock is created with mode 0666 and no peer-credential check. Any local user can send a collect command with an arbitrary output path, and the agent writes the collected bundle as root. I used this to write into /etc/sudoers.d and get a root shell on a stock install of 4.2.1. It also worked on 4.1.x.

To reproduce: install Kunnus Agent 4.2.1 on Debian 12 from the .deb, then as an unprivileged user run printf '{"cmd":"collect","out":"/etc/sudoers.d/zz"}' | socat - UNIX-CONNECT:/var/run/kunnus-agent.sock, wait ~2 s for the agent to flush the bundle, and sudo -l now shows NOPASSWD: ALL for the calling user. Script and strace attached.

Happy to coordinate — I intend to publish 90 days from today.

Attachments

exploit.sh · 1.2 KB agent-strace.txt · 44 KB screencap.mp4 · 3.1 MB

✓{{ ph.label }}{{ ph.meta }}

✓ {{ st.label }} {{ st.verdict }}{{ st.note }} {{ st.stamp }}

Acknowledge receipt

Sends the standard acknowledgement with the tracking ID. Assigns the disclosure to you and records the time.

Products from the catalogue — tick what the report applies to

Reproduced

Valid vulnerability

“Not a vulnerability” covers documented, intended behaviour. The reporter is told the outcome and your reasoning.

Severity — CVSS v4.0

Reporter claims Critical. Calculate from the report's facts rather than accept the claim.

Actively exploited?

Attach what you are relying on — a log excerpt, a screenshot, a third-party report.

This starts the CRA Article 14 early-warning clock — 24 hours from the record.

A proof of concept in the report is not exploitation.

Actively exploited — the CRA early warning is due {{ earlyWarningDue }} regardless of this plan. Dates below are the remediation timeline.

The mitigation — what users are told to do

Tested and ready to communicate

Distribution, signing and update channels follow the product's documented process — not repeated per case.

Critical — publish as soon as the remediation is available. The gap between fix and advisory is exploitation window.

CSAF 2.0 security advisory {{ csafFile }} · draft

Advisory ID {{ advId }}

Title

Release date {{ advReleaseDate }} from the plan

Affected products {{ inputProducts }}

Fixed in {{ fixedIn }}

CVE

Severity {{ advSeverity }}{{ cvssVector }}

Description

Potential impact

Remediations

Publish advisory

{{ st.q }}