CVE-2026-26899
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In luci-app-https-dns-proxy on OpenWrt (PR #15, before 2026-01-17), the setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter.
Risk Assessment
An authenticated attacker can take over the OpenWrt device by executing arbitrary commands, leading to full system compromise.
Recommendation
Update luci-app-https-dns-proxy to version from 2026-01-17 or later, which includes the fix.
Other vulnerabilities in luci-app-https-dns-proxy
See all- CVE-2026-46368High
Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.
- CVE-2026-67352High
A stored XSS vulnerability in luci-app-https-dns-proxy allows authenticated users to inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Original NVD description (English source)
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
Vulnerability data from NVD (NIST) · CISA KEV · EPSS