Clickjacking Vulnerability in Ajenti Admin Panel

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: MITRE

Description

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI start_response() without adding anti-framing protections such as X-Frame-Options or a Content-Security-Policy frame-ancestors restriction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-38979

Affected Vendors & Products

Vendor	Product	Version / Range
ajenti	ajenti	to 2.2.13 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a clickjacking weakness found in ajenti versions up to 2.2.13. It occurs in the browser-facing login and administrative user interface. The core HTTP response handling in ajenti does not include anti-framing protections such as the X-Frame-Options header or Content-Security-Policy frame-ancestors restrictions. As a result, attackers can potentially trick users into interacting with the ajenti interface through hidden or disguised frames on malicious websites.

Impact Analysis

The impact of this vulnerability is that an attacker could use clickjacking techniques to deceive users into performing unintended actions on the ajenti administrative interface. This could lead to unauthorized changes or access if an authenticated user is tricked into clicking on hidden controls, potentially compromising system security or administrative functions.

Hi! I’m here to help you understand CVE-2026-38979. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70