CVE-2026-23893

CVE-2026-23893 is a symlink-following vulnerability in openCryptoki versions 2.3.2 and above, a PKCS#11 library for Linux and AIX. A low-privileged token-group user can exploit this when openCryptoki runs in a privileged context, such as root, by planting symlinks in group-writable token directories. This can lead to privilege escalation or data exposure if an administrator runs a PKCS#11 application or administrative tool that performs chown on files within these directories. The vulnerability has a CVSS score of 6.8 (Medium), indicating a local attack vector with low attack complexity, requiring user interaction. Successful exploitation can result in high confidentiality and integrity impacts, with a low availability impact. Currently, there is no known active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite this, the CVE has garnered significant community discussion with 11 mentions and has been covered in one media article, suggesting notable awareness within the security community.