CVE-2026-88834

Awaiting Analysis Awaiting Analysis - Queue

Username Enumeration in BusyBox httpd Server

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88834

EUVD

EUVD-2026-98899

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Hardened Images *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-203	The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in BusyBox's httpd web server when configured with system password authentication. It allows an attacker to determine if a username exists by observing authentication failure behavior, creating a user existence oracle. The impact is limited to username enumeration and requires specific non-default build configurations or uncommon password file states.

Detection Guidance

To detect this vulnerability, monitor BusyBox httpd authentication responses for unusual patterns. Check if system password authentication is enabled in httpd.conf and if non-default compile options are used. Look for discrepancies in failure messages between existing and non-existing usernames.

Impact Analysis

An attacker could exploit this to identify valid usernames on a system running the vulnerable BusyBox httpd server. This could aid further attacks like brute force or social engineering. However, default builds with shadow password support are not affected.

Compliance Impact

This vulnerability primarily enables username enumeration, which could indirectly impact compliance by exposing user account information. However, its limited scope (non-default configurations, low CVSS score) and lack of direct data exposure suggest minimal regulatory impact unless combined with other factors.

Mitigation Strategies

Avoid using system-password wildcards in httpd.conf. Switch to PAM-based authentication if possible. Ensure BusyBox is built with FEATURE_SHADOWPASSWDS enabled, which is the default setting. Update or rebuild BusyBox to a patched version if available.

Hi! I’m here to help you understand CVE-2026-88834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70