iSCSI Enterprise Target (iscsitarget) 0.4.15 uses weak permissions for /etc/ietd.conf, which allows local users to obtain passwords.

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 1

• DTSA-106-1 iscsitarget - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026

References

• 27483 third-party-advisory
• iscsi-etcietdconf-information-disclosure(38228) vdb-entry
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=448873
• 26299 vdb-entry
• 42037 vdb-entry