Skip to content
OpenAdvisories
High ALAS2-2026-3831 1 CVE

Important: acl security update (Amazon Linux 2)

Published Aug 3, 2026 · Updated Aug 4, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-54369: A flaw was found in the `acl` component, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 acl 0:2.2.51-14.amzn2.0.1
Amazon Linux · 2 acl-debuginfo 0:2.2.51-14.amzn2.0.1
Amazon Linux · 2 libacl 0:2.2.51-14.amzn2.0.1
Amazon Linux · 2 libacl-devel 0:2.2.51-14.amzn2.0.1

Vulnerabilities 1

  • High 7.1
    CVE-2026-54369

    acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

    acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathn…

    acl project acl acl acl Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-54369.html