luci-app-samba4 ACL Command Execution in OpenWrt

Executive Summary

CVE-2026-59260 is a vulnerability in the OpenWrt luci-app-samba4 package where a read ACL incorrectly grants authenticated users permission to execute the Samba daemon (smbd) via the rpcd file.exec function.

This means that a delegated user with read-only Samba access can execute arbitrary commands as root by passing controlled command-line arguments to smbd, which accepts runtime configuration overrides such as --option=message command=....

When combined with an SMB message request, this triggers the configured command, leading to root command execution. The root cause is that the ACL treats smbd execution as a read-only operation, but smbd's design allows caller-controlled configuration that can execute commands.

Exploitation requires an authenticated session with the vulnerable ACL; unauthenticated remote access is not possible.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker with delegated read-only Samba access to escalate privileges and execute arbitrary commands as root on the affected system.

Such command execution can lead to complete system compromise, allowing attackers to control the system, access sensitive data, or disrupt services.

Because the Samba daemon runs with root privileges, the impact is severe and can affect the confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying if the OpenWrt luci-app-samba4 package grants read ACL permissions that include file.exec on /usr/sbin/smbd, allowing authenticated users to execute the Samba daemon with caller-controlled arguments.

Since the exploit requires an authenticated session, monitoring SMB sessions for unusual command-line arguments passed to smbd or unexpected execution of smbd with runtime configuration overrides may help detect exploitation attempts.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to remove the /usr/sbin/smbd exec permission from the read ACL in the luci-app-samba4 configuration.

Avoid granting file.exec permissions to daemons like smbd that accept configurable command-line options.

Applying any available patches or updates from OpenWrt that address this vulnerability is also advised.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenWrt luci-app-samba4 allows authenticated users to execute arbitrary commands as root, leading to potential complete system compromise.

Such a security flaw can impact compliance with common standards and regulations like GDPR and HIPAA because unauthorized command execution and privilege escalation can lead to unauthorized access, modification, or disclosure of sensitive data.

This undermines the confidentiality, integrity, and availability requirements mandated by these regulations, potentially resulting in data breaches or system integrity violations.

Useful 0 Not Useful 0