CVE-2026-109970 — Clevis: clevis: pkcs#11 token pin written to world-readable file
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Und…
Published: 2026-10-14 · CVSS: 4.7 · CVSS 3.1
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7