CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability

Patch now

HIGH 7.8EXPLOITEDWATCHLISTUPGRADEMITIGATEMITIGATE

CVE-2021-3560 is a high-severity flaw (CVSS 7.8) affecting polkit, debian linux, ubuntu linux, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Why this priority

High severity
EPSS top 2%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	23.7% (top 2%)
CISA exploited list	Yes, fix due 2023-06-02
Weakness	CWE-863, CWE-754
Published	2022-02-16
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: canonical · debian · polkit project · redhat

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-02-16 19:15 UTCPublished CVE record published
2023-05-12Exploited Added to the CISA Known Exploited Vulnerabilities list
2023-06-02Deadline CISA due date for US federal agencies to patch
2026-06-17 04:05 UTCUpdated Record last modified

polkit project polkit UPGRADE

Affected: < 0.119

Fixed in: 0.119

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy polkit || rpm -q polkit || polkit --version

2. UPGRADE to 0.119 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade polkit

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade polkit

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

debian debian linux MITIGATE

Affected: 11.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

canonical ubuntu linux MITIGATE

Affected: 20.04

Fixed in: no fixed release known

Safe to downgrade to: a release before 20.04

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

redhat virtualization DOWNGRADE

Affected: 4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.0

1. Check installed version

apt-cache policy virtualization || rpm -q virtualization || virtualization --version

2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)

apt-cache madison virtualization sudo apt install virtualization=<VERSION_BEFORE_4.0> sudo apt-mark hold virtualization

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list virtualization sudo dnf downgrade virtualization-<VERSION_BEFORE_4.0> sudo dnf versionlock add virtualization

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat virtualization host DOWNGRADE

Affected: 4.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.0

1. Check installed version

apt-cache policy virtualization-host || rpm -q virtualization-host || virtualization-host --version

2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)

apt-cache madison virtualization-host sudo apt install virtualization-host=<VERSION_BEFORE_4.0> sudo apt-mark hold virtualization-host

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list virtualization-host sudo dnf downgrade virtualization-host-<VERSION_BEFORE_4.0> sudo dnf versionlock add virtualization-host

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat openshift container platform DOWNGRADE

Affected: 4.7

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.7

1. Check installed version

apt-cache policy openshift-container-platform || rpm -q openshift-container-platform || openshift-container-platform --version

2. No fixed release: DOWNGRADE to a release before 4.7 (Debian / Ubuntu)

apt-cache madison openshift-container-platform sudo apt install openshift-container-platform=<VERSION_BEFORE_4.7> sudo apt-mark hold openshift-container-platform

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list openshift-container-platform sudo dnf downgrade openshift-container-platform-<VERSION_BEFORE_4.7> sudo dnf versionlock add openshift-container-platform

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · nemo · FIXED · 6.8.0-1.fc46 · FEDORA-2026-0edead723f · source

sudo dnf upgrade --advisory=FEDORA-2026-0edead723f

Fedora ELN · composer · FIXED · 2.11.1-1.eln159 · FEDORA-2026-cb4f992456 · source

sudo dnf upgrade --advisory=FEDORA-2026-cb4f992456

Ubuntu 22.04 · policykit-1 · FIXED · 0.105-31

sudo apt update && sudo apt install --only-upgrade policykit-1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' policykit-1)" ge "0.105-31" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 20.04 · policykit-1 · FIXED · 0.105-26ubuntu1.1

sudo apt update && sudo apt install --only-upgrade policykit-1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' policykit-1)" ge "0.105-26ubuntu1.1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · policykit-1 · FIXED · 0.105-31

sudo apt update && sudo apt install --only-upgrade policykit-1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' policykit-1)" ge "0.105-31" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · policykit-1 · FIXED · 0.105-31

sudo apt update && sudo apt install --only-upgrade policykit-1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' policykit-1)" ge "0.105-31" && echo PATCHED || echo STILL-VULNERABLE

RHEL 8 · polkit · FIXED · polkit-0.115-11.el8_4.1

sudo dnf upgrade --advisory=RHSA-2021:2238 rpm -q polkit

RHEL 8.1 Extended Update Support · polkit · FIXED · polkit-0.115-9.el8_1.1

sudo dnf upgrade --advisory=RHSA-2021:2236 rpm -q polkit

RHEL 8.2 Extended Update Support · polkit · FIXED · polkit-0.115-11.el8_2.1

sudo dnf upgrade --advisory=RHSA-2021:2237 rpm -q polkit

RHEL 6 · polkit · NOT AFFECTED

RHEL 7 · polkit · NOT AFFECTED

Alpine 3.20 · polkit · FIXED · polkit-0.119-r0

apk add --upgrade polkit apk info -v polkit

Alpine 3.21 · polkit · FIXED · polkit-0.119-r0

apk add --upgrade polkit apk info -v polkit

Alpine 3.22 · polkit · FIXED · polkit-0.119-r0

apk add --upgrade polkit apk info -v polkit

Alpine 3.23 · polkit · FIXED · polkit-0.119-r0

apk add --upgrade polkit apk info -v polkit

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: secnigma/CVE-2021-3560-Polkit-Privilege-Esclation (126 stars)
GitHub PoC: Almorabea/Polkit-exploit (125 stars)
GitHub PoC: RicterZ/CVE-2021-3560-Authentication-Agent (116 stars)
Write-up: github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/
GitHub PoC: 0dayNinja/CVE-2021-3560
GitHub PoC: Antoine-MANTIS/POC-Bash-CVE-2021-3560
Exploit-DB: Polkit 0.105-26 0.117-2 - Local Privilege Escalation
Metasploit: Polkit D-Bus Authentication Bypass

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-3560?

polkit: upgrade to 0.119; debian linux: mitigate or apply the listed mitigation; ubuntu linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2021-3560 being exploited?

Yes. CVE-2021-3560 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2021-3560 affect?

CVE-2021-3560 affects polkit, debian linux, ubuntu linux. Severity is high (CVSS 7.8). It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create

How urgent is CVE-2021-3560?

Priority 87/100. High severity; EPSS top 2%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; On your watchlist

Software pages

Ubuntu vulnerabilities · Debian vulnerabilities · Red Hat OpenShift vulnerabilities

Related CVEs

CVE-2026-4897 MEDIUM 5.5 MITIGATE DOWNGRADE A flaw was found in polkit
CVE-2021-4034 HIGH 7.8 EXPLOITED UPGRADE DOWNGRADE Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
CVE-2021-4115 MEDIUM 5.5 DOWNGRADE MITIGATE There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file d

References

← Back to latest CVEs