Read the docs
TI-2009-02798 Aliases CVE-2009-2936GHSA-vq42-25hh-c536

The Command Line Interface (aka Server CLI or administration interface) in the master…

Priority HIGH 68CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.

Why it matters now

EPSS 0.63824 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:varnish.projects.linpro:varnish:0.9:*:*:*:*:*:*:*0.9VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:0.9.1:*:*:*:*:*:*:*0.9.1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.0:*:*:*:*:*:*:*1.0VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.1:*:*:*:*:*:*:*1.1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:1.1.2:*:*:*:*:*:*:*1.1.2VulnerableVarnish.projects.linpro
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:varnish.projects.linpro:varnish:2.0:*:*:*:*:*:*:*2.0VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta1:*:*:*:*:*:*2.0 beta1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0:beta2:*:*:*:*:*:*2.0 beta2VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0:rc1:*:*:*:*:*:*2.0 rc1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableVarnish.projects.linpro
cpe:2.3:a:varnish.projects.linpro:varnish:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableVarnish.projects.linpro

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2936
  2. 2026-10-03 Alias added: GHSA-vq42-25hh-c536

References

Advisory 1

Other 2

  • TI-2009-04249 Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences