CVE-2026-26899

Deferred Deferred - Pending Action

Remote Code Execution in OpenWrt luci-app-https-dns-proxy

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: MITRE

Description

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-26899

EUVD

EUVD-2026-67101

Affected Vendors & Products

Vendor	Product	Version / Range
stangri	luci-app-https-dns-proxy	to 2026-01-17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in luci-app-https-dns-proxy on OpenWrt. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands by injecting shell metacharacters into the name parameter.

Detection Guidance

Check if the vulnerable luci-app-https-dns-proxy package is installed by running opkg list-installed | grep luci-app-https-dns-proxy. If installed, verify the version is older than the patched release from January 16, 2026.

Impact Analysis

An attacker with authenticated access could escalate privileges from a limited user account to root access. This could allow full system compromise, enabling attackers to execute any command on the system as root.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially exposing sensitive data. For GDPR, it may result in data breaches requiring notification under Article 33. For HIPAA, it could compromise protected health information, violating the Security Rule. Unauthorized command execution may also violate access control requirements in both standards.

Mitigation Strategies

Update the luci-app-https-dns-proxy package to the latest version immediately. If an update is not available, consider disabling the package or restricting access to authenticated users with minimal privileges until a patch is applied.

Hi! I’m here to help you understand CVE-2026-26899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70