A flaw was found in firewalld

CVE-2026-4948 is a local firewalld mis-authorization flaw in the D-Bus setters setZoneSettings2 and setPolicySettings. In vulnerable builds, those setters are protected with PK_ACTION_CONFIG_INFO instead of PK_ACTION_CONFIG, which matters because the shipped desktop polkit profile allows configuration *inspection* without authentication. Upstream, the bug affects firewalld <= 2.4.0; the fix lands in v2.4.1. Debian shows backported fixes in 0.9.3-2+deb11u1 for bullseye and 2.3.1-1+deb13u1 for trixie, while SUSE ships fixed package builds such as firewalld >= 1.3.4-150600.13.6.1 on SLES 15 SP6/SP7.

The vendor’s MEDIUM 5.5 rating is technically fair in a lab, but it is too generous for enterprise patch triage. Real-world exploitation requires local unprivileged code execution or shell access first, then a host that actually uses the desktop policy profile, and the outcome is runtime firewall-state tampering on that one host, not remote takeover. That is classic post-initial-access friction, so this gets downgraded to LOW.

Why this verdict

• Downward adjustment: requires local unprivileged access first — this is not an initial-access bug, not a perimeter bug, and not something an unauthenticated remote attacker can hit.
• Downward adjustment: desktop policy prerequisite narrows the blast radius — the exploitable path depends on the shipped desktop polkit profile being present/active, which is not how most headless Linux servers are run.
• Downward adjustment: impact is host-local and runtime-scoped — the attacker can tamper with the running firewall state on one machine, but this is not code execution and not an immediate fleet-wide persistence mechanism.

Why not higher?

If this were remotely reachable, unauthenticated, or broadly exposed across server fleets, the integrity impact to firewall policy would justify a much higher rating. But the chain is gated by local access first and then by a specific desktop authorization profile, which strips away most of the theoretical severity.

Why not lower?

It is still a real authorization flaw in a security control, not bookkeeping noise. On shared Linux workstations, developer boxes, VDI-style Linux desktops, or jump hosts where firewalld meaningfully segments traffic, an unprivileged user can weaken host filtering immediately and aid lateral movement.

1. Audit for desktop Firewalld polkit policy — Identify hosts carrying the desktop Firewalld policy file and prioritize them over generic firewalld installs. For a LOW verdict there is no SLA — treat as backlog hygiene, but this is the fastest way to separate truly exposed endpoints from noise.
2. Remove or replace the desktop policy on shared systems — On multi-user Linux workstations and jump hosts, prefer the stricter server-style policy or remove unneeded GUI management components so config.info is not enough to reach sensitive runtime setters. For LOW, there is no SLA — treat as backlog hygiene and bundle this into desktop hardening baselines.
3. Watch for runtime firewall drift — Alert on unexpected firewall-cmd, busctl, gdbus, and direct D-Bus access to org.fedoraproject.FirewallD1, then compare runtime vs permanent rules. For LOW, there is no SLA — treat as backlog hygiene, but it is a useful detective control on admin workstations and shared Linux hosts.
4. Reduce local foothold opportunities — This vulnerability only matters after a local foothold, so hardening SSH, PAM, sudo, browser isolation, and endpoint controls cuts the only realistic entry path. For LOW, there is no SLA — treat as backlog hygiene.

Run this on the target Linux host, not from a scanner workstation. Save it as check-cve-2026-4948.sh and execute sudo bash check-cve-2026-4948.sh; root is preferred so the script can inspect installed firewalld Python sources and polkit action files without path/permission surprises.

#!/usr/bin/env bash
# check-cve-2026-4948.sh
# Detects likely exploitable state for CVE-2026-4948.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

status="UNKNOWN"
reason=""

find_firewalld_py() {
  local candidates=(
    /usr/lib*/python*/site-packages/firewall/server/firewalld.py
    /usr/lib*/python*/dist-packages/firewall/server/firewalld.py
    /usr/lib/firewalld/firewalld.py
  )
  local f
  for pattern in "${candidates[@]}"; do
    for f in $pattern; do
      [ -f "$f" ] && { echo "$f"; return 0; }
    done
  done
  return 1
}

has_vuln_decorator() {
  local file="$1"
  python3 - "$file" <<'PY'
import sys
path = sys.argv[1]
with open(path, 'r', encoding='utf-8', errors='ignore') as fh:
    lines = fh.readlines()

def prev_nonempty(idx):
    j = idx - 1
    while j >= 0:
      s = lines[j].strip()
      if s:
        return s
      j -= 1
    return ""

z = False
p = False
for i, line in enumerate(lines):
    s = line.strip()
    if s.startswith('def setZoneSettings2('):
        z = 'PK_ACTION_CONFIG_INFO' in prev_nonempty(i)
    if s.startswith('def setPolicySettings('):
        p = 'PK_ACTION_CONFIG_INFO' in prev_nonempty(i)

if z and p:
    print('VULN')
    sys.exit(0)
else:
    print('PATCHED_OR_UNKNOWN')
    sys.exit(1)
PY
}

has_desktop_policy() {
  local dir file
  for dir in /usr/share/polkit-1/actions /etc/polkit-1/actions; do
    [ -d "$dir" ] || continue
    while IFS= read -r -d '' file; do
      if grep -q 'org.fedoraproject.FirewallD1.config.info' "$file" 2>/dev/null && \
         grep -q 'org.fedoraproject.FirewallD1.policies.info' "$file" 2>/dev/null && \
         grep -q '<allow_active>yes</allow_active>' "$file" 2>/dev/null; then
        echo "$file"
        return 0
      fi
    done < <(find "$dir" -maxdepth 1 -type f -name '*FirewallD*.policy' -print0 2>/dev/null)
  done
  return 1
}

firewalld_py="$(find_firewalld_py 2>/dev/null || true)"
if [ -z "$firewalld_py" ]; then
  echo "UNKNOWN - could not locate installed firewalld Python service file"
  exit 2
fi

if has_vuln_decorator "$firewalld_py" >/dev/null 2>&1; then
  desktop_policy="$(has_desktop_policy 2>/dev/null || true)"
  if [ -n "$desktop_policy" ]; then
    echo "VULNERABLE - vulnerable setters found in $firewalld_py and desktop polkit policy present at $desktop_policy"
    exit 1
  else
    echo "UNKNOWN - vulnerable setters found in $firewalld_py but no desktop polkit policy detected; prerequisite may be absent"
    exit 2
  fi
else
  echo "PATCHED - vulnerable setter decorators not detected in $firewalld_py"
  exit 0
fi

Sources

1. NVD CVE-2026-4948
2. Red Hat CVE page
3. Red Hat Bugzilla 2452086
4. firewalld v2.4.1 release
5. firewalld fix commit 8cb2ded
6. Debian security tracker CVE-2026-4948
7. SUSE CVE-2026-4948
8. CISA Known Exploited Vulnerabilities Catalog