Pardus Linux Vulnerability Lets Local Attackers Gain Silent Root Access

A critical privilege escalation vulnerability chain, tracked as CVE-2026-5140, has been discovered in the Pardus Linux update mechanism, allowing local users to gain full root access without authentication.

The issue, rated CVSS 9.3 (Critical), affects the pardus-update package and stems from a combination of three distinct flaws that, when chained together, enable complete system compromise within seconds.

Pardus Linux Vulnerability

Pardus Linux, a Debian-based distribution maintained by TÜBİTAK and widely deployed across government and educational environments in Turkey, relies on the pardus-update utility for system updates. This tool uses PolicyKit (Polkit) to execute privileged operations via Python scripts.

Security researcher Çağrı Eser (0xc4gr1) identified that three weaknesses, authorization bypass, input injection, and unsafe file handling, can be combined to achieve silent privilege escalation from any unprivileged local account.

The attack chain consists of the following components:

• Polkit Authorization Bypass (CWE-285):
• Misconfigured Polkit policy files allow any user to execute privileged update actions without authentication. Critical actions such as package updates and system configuration changes are set to “allow_any=yes,” effectively granting root-level execution via pkexec.
• CRLF Injection in Configuration Handling (CWE-93):
• The SystemSettingsWrite.py script improperly sanitizes user input. While newline characters are filtered, carriage return (\r) characters are not. This allows attackers to inject arbitrary configuration entries into /etc/pardus/pardus-update.conf.
• Untrusted APT Source Path (CWE-426):
• The AutoAptUpgrade.py script reads attacker-controlled configuration values and copies arbitrary APT repository files into /etc/apt/sources.list.d/ without validation. This enables execution of malicious packages during system updates.

Proof of Concept (Simplified)

An attacker can exploit the chain in two steps:

1. Inject a malicious repository path into the configuration file:

pkexec SystemSettingsWrite.py write lastupgrade $'123\rcustom_sourcesd_path=/tmp/pwn.list'

1. Trigger the update process to install a malicious package:

pkexec AutoAptUpgrade.py

The malicious package can include a post-install script that sets the SUID bit on /bin/bash, allowing persistent root access:

chmod +s /bin/bash

After execution, attackers can spawn a root shell using:

/bin/bash -p

The vulnerability has severe security implications:

• Confidentiality: Full access to sensitive files such as /etc/shadow
• Integrity: Ability to modify system binaries, install backdoors, or deploy rootkits
• Availability: Complete system takeover
• Scope: Escalation from user-level access to full root privileges

Any system with local user access, including shared machines or compromised accounts—is at risk.

Mitigation and Fixes

To fully remediate the issue, administrators should apply the following fixes:

• Harden Polkit Policies: Replace permissive allow_any=yes settings with auth_admin to enforce authentication.
• Sanitize Input Properly: Strip both \r and \ n characters from user input in configuration scripts.
• Validate APT Sources: Restrict repository paths to trusted directories and block world-writable locations such as /tmp.

Example fix for input sanitization:

timestamp = sys.argv[3].replace('\r', '').replace('\n', '')

Timeline and Attribution

• Discovered: March 13, 2026
• Researcher: Çağrı Eser (0xc4gr1)
• Vulnerability Classes: CWE-285, CWE-93, CWE-426

Organizations using Pardus Linux should immediately audit systems for vulnerable configurations and apply patches. Monitoring for unauthorized APT sources and unusual privilege escalations is also recommended as part of ongoing detection efforts.

This case highlights how seemingly minor misconfigurations can combine into a critical exploit chain, emphasizing the importance of secure defaults, strict input validation, and proper privilege enforcement in system design.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.