Incorrect permissions in filelock let local users end lock holds
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Partial Red Hat: 15 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
filelock from 3.30.0 before 4.2.1 creates StrictSoftFileLock claim directories on POSIX systems without applying the caller's restrictive lock mode (CWE-732). A permissive umask or inherited default ACL can leave them writable by other local users. A local user with a write bit on those directories can delete an active holder's claims, so another process acquires the lock while the original holder is still in its critical section.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tox-dev | filelock | 3.30.0 to before 4.2.1 | 4.2.1 | Patch available | CNA |
| — | filelock (PyPI) | 3.30.0 to before 4.2.1 | 4.2.1 | Patch available | GHSA-6627-m3xw-93mp |
- filelock Vendortox-dev Affected 3.30.0 to before 4.2.1 Fixed in 4.2.1 Patch available CNA
- filelock (PyPI) Vendor— Affected 3.30.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-6627-m3xw-93mp
Remediation
The fix is in filelock 4.2.1 for the tox-dev and PyPI packages. Red Hat lists Ansible Automation Platform 2 as affected with no fix plan available, along with Ansible Automation Orchestrator 2026, Exploit Intelligence, Lightspeed Core, Lightspeed Services for Advanced Cluster Management, and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA filelock (tox-dev) Fixed in 4.2.1
- Fix · GHSA-6627-m3xw-93mp filelock (PyPI) Fixed in 4.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | — |
| Exploit Intelligence | Affected | — |
| Lightspeed Core | Affected | — |
| Lightspeed Services for Advanced Cluster Management | Affected | — |
| OpenShift Lightspeed | Affected | — |
| Pen Drive Powered by Red Hat Lightspeed | Affected | — |
| Red Hat AI Inference Server | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform Ansible Core 2 | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | — |
| Red Hat Lightspeed Services for OCP | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Red Hat OpenShift Dev Spaces | Affected | — |
| Red Hat Satellite 6 | Affected | — |
Not affected: 1 product
- Red Hat Ansible Automation Platform 2
Timeline
- 2026-11-05 Threatist record created from CVE-2026-112908
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 6
- https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp
- https://github.com/tox-dev/filelock/pull/839
- https://github.com/tox-dev/filelock/commit/8cf51802158b9cf7e1fc560c2da30491a662cfde
- https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
- https://github.com/tox-dev/filelock
More tox-dev vulnerabilities
- TI-2026-76862 Symlink race in filelock ReadWriteLock lets attackers overwrite files CVSS 3.1HIGH 7.1
- TI-2026-76853 filelock soft locks adopt directories created by other local users CVSS 3.1MEDIUM 6.3
- TI-2026-76859 Symlink following in filelock ReadWriteLock redirects SQLite database CVSS 3.1MEDIUM 6.1
- TI-2026-76857 Unsafe holder record refresh in filelock SoftReadWriteLock CVSS 3.1MEDIUM 6.1
- TI-2026-76852 filelock UnixFileLock truncates files placed on the lock path CVSS 3.1MEDIUM 6.1
- TI-2026-76856 Crafted lock database makes filelock ReadWriteLock acquisitions hang CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-112908 · CVE Program
- CVE-2026-112908 · NVD
- FIRST EPSS
- CVE-2026-112908 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences