CVE-2026-79920
Received Received - Intake

Authenticated Plugin Management Flaw in Ajenti Enables Root Code Execution

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-79920
EUVD
EUVD-2026-84010

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ajenti ajenti to 2.2.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79920 is a critical vulnerability in Ajenti, a server admin panel. It allows any authenticated user to execute plugin installation, uninstallation, or upgrade tasks without proper authorization. The tasks use unvalidated user input to construct pip package specifications, enabling attackers to install malicious packages with root privileges. This leads to full system compromise.

Detection Guidance

Check Ajenti version with command: ajenti --version. If version is <=2.2.15, the system is vulnerable. Inspect network traffic for unauthorized POST requests to /api/core/tasks/start endpoint from authenticated users.

Impact Analysis

An attacker with low-level access can exploit this to install, remove, or upgrade plugins as root. This results in arbitrary code execution, full host takeover, and potential data breaches or system destruction. The impact includes loss of confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity. GDPR requires safeguarding personal data, which could be compromised by root access. HIPAA mandates strict access controls for sensitive health data. Exploitation could lead to unauthorized access, breaches, and non-compliance penalties.

Mitigation Strategies

Upgrade Ajenti to version 2.2.16 or later immediately. Restrict access to the /api/core/tasks/start endpoint to authorized users only. Review user permissions to ensure only administrators can manage plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart