CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 23.7% chance of exploitation in the next 30 days.

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products

• Canonical Ubuntu Linux: version 20.04 only
• Debian Debian Linux: version 11.0 only
• Polkit Project Polkit: before 0.119 (fixed in 0.119)
• Red Hat Openshift Container Platform: version 4.7 only
• Red Hat Virtualization: version 4.0 only
• Red Hat Virtualization Host: version 4.0 only

Published 2022-02-16. Last modified 2026-06-17.