PT-2026-32031 · Ajenti · Ajenti-Plugin-Core

CVE-2026-40177 · Published 2026-04-10 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ajenti.plugin.core versions prior to 0.112

Description Prior to version 0.112, if two-factor authentication (2FA) was enabled, password authentication could be bypassed. This allowed unauthorized access to the system.

Recommendations Upgrade to version 0.112 to resolve this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-40177

GHSA-3MCX-6WXM-QR8V

PYSEC-2026-266

Affected Products

Ajenti-Plugin-Core

References · 12

• https://github.com/ajenti/ajenti/security/advisories/GHSA-3mcx-6wxm-qr8v · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3mcx-6wxm-qr8v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40177 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-266 · Vendor Advisory
• https://github.com/ajenti/ajenti · Note
• https://github.com/advisories/GHSA-3mcx-6wxm-qr8v · Note
• https://twitter.com/securitydailyr/status/2044521348886892938 · Twitter Post
• https://twitter.com/CVEnew/status/2042710182203982168 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042688962846720221 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042798089161838869 · Twitter Post
• https://pypi.org/project/ajenti-plugin-core · Note
• https://twitter.com/CCBalert/status/2043675647449370926 · Twitter Post