Is CVE-2026-109971 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109971?

CVE-2026-109971 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-109971

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.