PT-2026-67418 · Openwrt · Luci

Zwcrazythursday · CVE-2026-69096 · Published 2026-08-03 · Updated 2026-08-03

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd start method even though it performs mutating operations. The run ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-69096

Affected Products

Luci

References · 5

• https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv · Vendor Advisory
• https://github.com/openwrt/luci/commit/44618b5b53d9bdad5cd489e82e29688b4d0862c1 · Patch
• https://github.com/openwrt/luci/commit/f4d0a44950e42bcbb8eacf715a3493b276a4f3ac · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-69096 · Security Note
• https://vulncheck.com/advisories/openwrt-luci-app-dockerman-read-acl-remote-code-execution · Note