EIP-2026-103012

PRE-CVE

Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-103012. PoCs published by Charles Stevenson.

AI-analyzed exploit summary This exploit targets a predictable temporary file vulnerability in Cobalt RaQ's /usr/lib/authenticate utility, leveraging a symlink attack to gain root privileges via a cron job. It compiles and executes a setuid root shell.

Description

Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack

Exploits (1)

exploitdb WORKING POC VERIFIED
by Charles Stevenson · bashlocallinux
https://www.exploit-db.com/exploits/21733

This exploit targets a predictable temporary file vulnerability in Cobalt RaQ's /usr/lib/authenticate utility, leveraging a symlink attack to gain root privileges via a cron job. It compiles and executes a setuid root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Cobalt RaQ <= apache-1.3.20-RaQ4_1C3
No auth needed
Prerequisites: setuid root binary /usr/lib/authenticate · write access to /tmp
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026