Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/canonical/authd

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3GoPublished

    authd: Primary group ID is incorrectly set to value of UID

    CVE-2026-6970 · GHSA-fg3j-5w9g-hmg7

    Affected
    • Go github.com/canonical/authd >= 0.6.0, < 0.6.4
    Fixed in
    0.6.4· Vendor fix available
    Issue
    authd 0.6.0 contains a bug which can lead to an incorrect primary group ID. It affects users whose primary group ID (i.e. the GID in the user record) differs from their UID. There are two ways which can lead to this: 1. The user was created with authd < 0.5.4 (released June 2025). Those users were created with UID != GID. 2. The primary group of the user was modified manually with the authctl utility that is shipped with authd (authctl group set-gid). Another condition is that some user information must have changed in the identity provider (else the user record is not updated upon login). If that is the case, the next time an affected user logs in, authd will set their primary group ID to their UID. This could lead to local privileges escalation. Also, files and directories created by those users will be owned by that incorrect primary group, which may grant other local users access to those files which they shouldn't have. Users who are affected by the issue can run this script to…

    Recommended action: Upgrade to 0.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →