Log in Start free

Vulnerability · Published Apr 22, 2026 · Assigned by canonical

CVE-2026-35371uutils coreutils id Misleading Identity Reporting in Pretty Print Mode

Low 3.3

In plain English

A low-severity security flaw in coreutils from Uutils. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 97.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-coreutilsno fix listedDEBIAN-CVE-2026-35371
Debian:13rust-coreutilsno fix listedDEBIAN-CVE-2026-35371
Debian:14rust-coreutilsno fix listedDEBIAN-CVE-2026-35371
Ubuntu:24.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35371
Ubuntu:25.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35371
Ubuntu:26.04:LTSrust-coreutilsno fix listedUBUNTU-CVE-2026-35371
Ubuntu:26.10rust-coreutilsno fix listedUBUNTU-CVE-2026-35371

Affected products (as reported)

VendorProductVersions
Uutils coreutils see references

Weakness: CWE-451 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References