Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck
CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Execution
High 8.8
In plain English
A high-severity OS command injection in luci from openwrt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 88% of all known vulnerabilities).
Official description
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-cq4h-h8jr-3xqv) vendor-advisory
- Affected master snapshot commit (still vulnerable per advisory) patch
- Affected openwrt-25.12 snapshot commit (still vulnerable per advisory) patch
- VulnCheck Advisory: OpenWrt luci-app-dockerman Read ACL Remote Code Execution third-party-advisory