Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-58000luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey

High 8.8

In plain English

A high-severity OS command injection in luci-proto-openvpn from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.7%top 22.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.

Affected products (as reported)

Vendor	Product	Versions
openwrt	luci-proto-openvpn	0 – through 0.11.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-pm9w-522m-8rrh) vendor-advisory
Patch Commit patch
VulnCheck Advisory: luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey third-party-advisory