CVE-2026-69096
Received Received - Intake

OS Command Injection in OpenWrt luci-app-dockerman

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69096
EUVD
EUVD-2026-52289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openwrt luci-app-dockerman to 24.10|end_excluding=23.05 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenWrt luci-app-dockerman has an OS command injection flaw. The package's read ACL allows access to docker.* methods, including docker.container.ttyd_start, which performs mutating operations. The handler builds a shell command from user-controlled fields (id, cmd, uid) and passes it to system() without proper quoting or safe execution. An attacker with read ACL access can inject shell metacharacters to execute arbitrary commands as root via an HTTP POST to /ubus.

Detection Guidance

Detection requires checking for the presence of luci-app-dockerman with the vulnerable ucode docker_rpc.uc backend in OpenWrt master or openwrt-25.12 snapshots. Verify if the package exposes the docker.container.ttyd_start method via ubus. Check logs for suspicious HTTP POST requests to /ubus with parameters id, cmd, or uid.

Impact Analysis

An authenticated attacker with only read access to luci-app-dockerman could execute arbitrary commands as the root user on the affected OpenWrt system. This could lead to full system compromise, data theft, or further network infiltration. The attack requires network access and valid credentials for the web interface.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. A successful exploit may result in data breaches, unauthorized data access, or system modifications, which could lead to non-compliance with these regulations.

Mitigation Strategies

Disable or uninstall luci-app-dockerman if installed. Restrict access to the ubus interface by firewall rules. Monitor for unauthorized HTTP POST requests to /ubus. Upgrade to unaffected versions like openwrt-24.10 or openwrt-23.05 if possible. No patched version was available at the time of disclosure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69096. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart