Privilege Escalation via Permissive Polkit Maintenance Policy

CMS fields

• Advisory: Privilege Escalation via Permissive Polkit Maintenance Policy
• Advisory ID: BGSA-2026-002 (proposed; confirm availability)
• Reporter reference: BG-01
• CVE: Not assigned
• Severity: Critical (researcher-assessed; no CVSS score assigned)
• Affected version: 2.0.3 — commit bb3a210 (reproduced by the maintainer)
• Fixed version: 2.0.4 (maintainer-confirmed corrected release)
• Status: Draft — publication pending coordinated disclosure
• Meta title: BastionGuard Polkit Maintenance Privilege Escalation | BGSA-2026-002
• Meta description: Security advisory for a reported BastionGuard 2.0.3 Polkit maintenance authorization issue. Source-level mitigation is included in the reviewed 2.0.4 baseline.
• Index: No while draft; Yes after coordinated publication
• Redirect: None
• Suggested slug: polkit-maintenance-privilege-escalation

Advisory body (English)

Summary

A permissive Polkit maintenance action was reported to allow an active local desktop user to initiate privileged commands without administrator authentication.

Security impact

If the vulnerable policy is installed, a local user with an active desktop session may be able to obtain elevated system privileges.

Affected and fixed versions

The project maintainer reproduced the reported vulnerability in BastionGuard 2.0.3, commit bb3a210. The correction is included in BastionGuard 2.0.4, as confirmed by the maintainer and supported by the reviewed source and regression tests. Versions other than the confirmed affected revision have not been exhaustively assessed.

Remediation

• Require administrator authorization for maintenance actions (for example, auth_admin_keep instead of unrestricted active-session authorization).
• Do not authorize general-purpose shells through privileged executable mappings.
• Review installed Polkit policy files and ensure they match the fixed release package.

Recommended action: Upgrade to the verified official BastionGuard 2.0.4 build or a later maintained release.

Verification scope

The reviewed corrected source applies administrator authentication and does not map the affected action to a shell. The maintainer reproduced the affected historical behavior; independent privileged desktop-session retesting of the corrected build was not performed in this audit environment.

Credits

Reported by Shaik Ikram. The project thanks the researcher for the responsible security report and requests that publication be coordinated with the researcher’s agreed disclosure schedule.

References

• BastionGuard source repository
• Security policy

Timeline

• Report received: October 2026
• Disclosure date: To be agreed / added before publication
• Fix release date: Confirm from the published 2.0.4 release record

Editorial verification (not part of public advisory): Maintainer confirms reproduction on bb3a210 and remediation in 2.0.4. Before publication, record the released package/tag and date, reserve the advisory ID, agree disclosure timing and credit with the researcher, and evaluate CVE eligibility through the appropriate CNA. Do not invent a CVE or CVSS score.