CVE-2026-26899

Unknown

Published: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Summary

In luci-app-https-dns-proxy on OpenWrt (PR #15, before 2026-01-17), the setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter.

Risk Assessment

An authenticated attacker can take over the OpenWrt device by executing arbitrary commands, leading to full system compromise.

Recommendation

Update luci-app-https-dns-proxy to version from 2026-01-17 or later, which includes the fix.

Original NVD description (English source)

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter