Read the docs
TI-2026-48503 Aliases CVE-2026-69096GHSA-wjfh-jfr9-fxvm

OpenWrt luci-app-dockerman Read ACL Remote Code Execution

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0327 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtluci26.162.29621~507ab5e—No fix listedCNA
  • luci Vendoropenwrt Affected 26.162.29621~507ab5e Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-69096
  2. 2026-10-03 Alias added: GHSA-wjfh-jfr9-fxvm

References

Patch 2

Advisory 1

  • TI-2026-79903 Stack buffer overflow in odhcpd DHCPv6 IA reply handling CVSS 3.1CRITICAL 9.8
  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-79901 Use-after-free in odhcpd DHCPv6 IA handling CVSS 4.0HIGH 8.8
  • TI-2026-48502 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info CVSS 4.0HIGH 8.7
  • TI-2026-44407 luci-app-banip Log Monitor IP Extraction Bypass CVSS 4.0HIGH 8.7
  • TI-2026-51067 luci-app-openvpn Path Traversal RCE via instance_name2 CVSS 4.0CRITICAL 9.4
See all 168 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences