CVE-2023-49794 is a medium severity (CVSS 6.7) authentication bypass in KernelSU versions up to 0.7.1. An app named like the official manager can gain root. The GitHub advisory lists 0.7.2 as the patched version, though the CVE record says no patch existed, so update.
What's affected
The record says KernelSU 0.7.1 and prior are affected, because the logic that finds the manager app's APK path can be bypassed. Any app using the package name me.weishu.kernelsu can then take root on a device with the KernelSU module installed.
The weakness is CWE-290 (authentication bypass by spoofing). The vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. The GitHub advisory GHSA-8rc5-x54x-5qc4 rates it Moderate at 6.7.
Source conflict: the CVE record says no patched version was available at publication. The GitHub advisory page lists 0.7.2 as patched. The advisory is the more current source, so use 0.7.2 or later, and confirm in the KernelSU releases. The advisory describes the risk as applying when the official manager is removed and an app with the same package name is installed.
How to check if you're exposed
Open the KernelSU Manager and read the version. Anything at 0.7.1 or lower needs an update.
If you cannot open the manager, check the installed package version.
adb shell dumpsys package me.weishu.kernelsu | grep versionName
This applies only to devices where users chose to install KernelSU, which is common on enthusiast and test devices, not managed corporate fleets. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find devices in your fleet that run KernelSU or another root solution. Most managed fleets should have none.
- Update KernelSU to 0.7.2 or later and reinstall the official manager from the project's own release page.
- Do not install apps from untrusted sources on a rooted device.
- Remove root from devices that handle company data.
- Block rooted devices through your mobile device management policy.
Why it matters
A root solution decides which app gets superuser rights. If it identifies that app by something an attacker can imitate, such as a package name, the check fails and a hostile app can inherit full control of the device.
The risk needs local access and user action, which keeps the score in the medium band. It still shows why identity checks must bind to signing keys or file identity, not names. This CVE is not on the CISA KEV list.
Quick check
Does this affect normal Android phones?
Only devices with the KernelSU module installed.
Which version is patched?
The GitHub advisory lists 0.7.2. The CVE record says no patch existed, so verify in the project releases.
Sources
Last reviewed: 19 October 2026.
