CVE-2026-57200
Received Received - Intake

Authorization Bypass in Asterisk via ARI WebSocket

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-57200
EUVD
EUVD-2026-111394

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
asterisk asterisk < 20.20.1
asterisk asterisk >= 21.0.0-pre1, < 21.12.3
asterisk asterisk >= 22.0.0-pre1, < 22.10.1
asterisk asterisk >= 23.0.0-pre1, < 23.4.1
certified-asterisk certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Asterisk allows an authenticated attacker with read-only ARI permissions to bypass authorization and execute write operations via REST-over-WebSocket. This can lead to arbitrary module path loading and potential remote code execution under specific conditions.

Detection Guidance

Check if Asterisk HTTP web server is enabled and accessible. Verify ARI read-only credentials are not misconfigured. Inspect WebSocket connections for unauthorized REST operations. Review Asterisk logs for suspicious module loading or remote code execution attempts.

Impact Analysis

An attacker could gain unauthorized access to modify Asterisk configurations, execute malicious code, or disrupt telephony services. This requires valid read-only ARI credentials and HTTP server access, which is disabled by default.

Mitigation Strategies

Upgrade Asterisk to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 or Certified Asterisk 22.8-cert3. Disable HTTP web server if not needed. Restrict ARI access to trusted networks only. Ensure ARI credentials have minimal required permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart