Unauthorized credential switching (CVE-2026-58092)

What is affected, what to do

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.

Update FreeBSD OS to version 15.1-STABLE.

Affected

• FreeBSD gte 15.1-RELEASE..*
• FreeBSD gte 15.0-RELEASE..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible. One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group. As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array. If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0. Certain mac_do rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug. Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID. Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".

Source: BSI CSAF, BSI WID Portal, NVD (NIST), cvelistv5

Vendors and products

• FreeBSD FreeBSD
• Freebsd Project Freebsd OS

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• security.freebsd.orgadvisories/FreeBSD-SA-26:59.mac_do.ascVendor advisory

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 24.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • FreeBSD (15.0-p1, 15.0-p10, 15.0-p11, 15.0-p12, 15.0-p2, 15.0-p3 and 8 more individual versions)

   New references:

   • https://security.freebsd.org/advisories/FreeBSD-SA-26:59.mac_do.asc
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:*
   Reference type	added	—	FreeBSD: https://security.freebsd.org/advisories/FreeBSD-SA-26:59.mac_do.asc Types: Vendor Advisory

   Source identifier: nvd@nist.gov

2. 26.08.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
   SSVC assessment	added	—	{"id":"CVE-2026-58092","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-08-26T15:26:31.361683Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0