https://feed.craftedsignal.io/vendors/open-iscsi/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 08 Aug 2026 09:32:22 +0000https://feed.craftedsignal.io/briefs/2026-08-iscsiuio-auth-bypass/Sat, 08 Aug 2026 09:32:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-iscsiuio-auth-bypass/CVE-2026-44944 describes an authentication bypass vulnerability in the Open-iSCSI iscsiuio control socket that allows local attackers to perform unauthorized actions.The iscsiuio component of the Open-iSCSI project contains an authentication bypass vulnerability identified as CVE-2026-44944. The flaw exists within the implementation of the control-socket, which fails to properly authenticate requests. An unauthorized local attacker can leverage this weakness to interact directly with the control socket, potentially executing commands or modifying system state associated with iSCSI operations. This vulnerability poses a risk to systems relying on iSCSI storage, as it allows for privilege escalation or unauthorized control over storage connectivity by a local process or user. Defenders should prioritize updating Open-iSCSI packages to versions that implement proper socket-level authentication.

Impact

Successful exploitation allows a local user to bypass security controls and perform unauthorized operations within the iscsiuio service, potentially leading to unauthorized storage access or disruption of iSCSI services.

Recommendation

• Update the Open-iSCSI package to the latest version provided by your Linux distribution to remediate CVE-2026-44944.
• Review local system access logs to identify unauthorized attempts to communicate with the iscsiuio control socket.
• Apply the principle of least privilege to restrict access to the control socket if the application architecture permits.

]]>mediumadvisoryhttps://feed.craftedsignal.io/briefs/2026-08-open-iscsi-isns-vulnerability/Sat, 08 Aug 2026 09:32:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-open-iscsi-isns-vulnerability/A double-free vulnerability exists in the iSNS attribute decoder of the open-iscsi package, which may lead to memory corruption or application instability.The open-iscsi package contains a double-free vulnerability (CVE-2026-55995) located within its iSNS (Internet Storage Name Service) attribute decoder. A double-free occurs when an application attempts to free memory that has already been deallocated, which can lead to heap corruption and potentially allow an attacker to trigger an application crash or execute arbitrary code under specific conditions. This vulnerability impacts systems utilizing open-iscsi for iSCSI target and initiator connectivity. Defenders should prioritize patching systems running vulnerable versions of open-iscsi to mitigate the risk of denial-of-service or potential exploitation.

Impact

The vulnerability potentially allows for application instability, memory corruption, or service denial of the iSCSI service. If successfully exploited, this could disrupt storage connectivity for services relying on iSCSI, impacting enterprise infrastructure that depends on network-attached storage or storage area networks (SAN).

Recommendation

• Upgrade the open-iscsi package to the latest version provided by the distribution vendor to remediate CVE-2026-55995.
• Review package management logs or inventory tools to identify systems running older versions of open-iscsi.
• Monitor for unexpected service restarts of the open-iscsi daemon, as this may indicate an attempt to trigger the vulnerability or general instability.

]]>highadvisoryvulnerabilitylinuxprivilege-escalation