CVE-2026-26899 in luci-app-https-dns-proxy
Summary
by MITRE • 08/27/2026
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in luci-app-https-dns-proxy for OpenWrt, specifically within versions prior to PR #15 dated January 17, 2026, represents a critical server-side code injection flaw. This issue resides in the setInitAction function located at /usr/libexec/rpcd/luci.https-dns-proxy. The core technical defect is a failure to properly sanitize user-supplied input before it is passed to system shell commands. Specifically, the name parameter accepted by this RPC endpoint does not undergo rigorous validation or escaping of special characters that hold significance in Unix-like operating systems. This oversight allows an attacker who has successfully authenticated to the OpenWrt LuCI interface to inject arbitrary shell metacharacters into the request payload. When the backend processes these inputs, they are interpreted as executable commands rather than literal string data, leading directly to remote code execution with the privileges of the rpcd service, which typically operates with root-level access on embedded Linux systems like OpenWrt routers.
From a technical perspective, this vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The flaw arises because the application constructs shell commands using string concatenation or similar unsafe methods without employing parameterized execution functions that would treat user input strictly as data arguments rather than part of the command syntax. By leveraging metacharacters such as semicolons, pipes, ampersands, or backticks within the name field, an authenticated attacker can break out of the intended context and append additional commands to be executed by the underlying shell interpreter. This mechanism bypasses any logical controls that might otherwise restrict what actions are permissible through the web interface, effectively granting full administrative control over the device if the rpcd process runs with elevated privileges, which is standard practice for managing network configurations on OpenWrt systems.
The operational impact of this vulnerability is severe due to the nature of the target environment. Routers running OpenWrt often serve as gateways between internal local networks and the public internet, making them high-value targets for attackers seeking to pivot into larger corporate or home networks. Successful exploitation allows an attacker to execute arbitrary commands on the device, which can lead to a complete compromise of network integrity. Attackers may install persistent backdoors, modify firewall rules to allow unauthorized access, redirect DNS queries to malicious servers for phishing or man-in-the-middle attacks, or exfiltrate sensitive data traversing the network. Furthermore, because this vulnerability requires authentication, it poses a significant risk in environments where weak credentials are used or where session hijacking techniques have been employed to gain initial foothold within the LuCI interface. The ability to execute commands as root means that once exploited, there is typically no effective technical control remaining on the device itself without physical access or factory reset procedures.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective mitigation is to upgrade luci-app-https-dns-proxy to a version released after PR #15 dated January 17, 2026, which contains the necessary input validation fixes. Administrators should verify their current package versions through the LuCI interface or via command line tools like opkg list-upgradable and apply updates promptly. In cases where immediate patching is not feasible due to operational constraints, temporary mitigations include restricting access to the LuCI web interface by IP address using firewall rules, ensuring that strong, complex passwords are enforced for all administrative accounts, and disabling unnecessary services or RPC endpoints if they are not required for daily operations. Additionally, implementing network segmentation can limit the blast radius of a potential compromise, preventing an attacker from leveraging the router as a pivot point to attack other devices on the local subnet.
This vulnerability aligns with several tactics in the MITRE ATT&CK framework, particularly those related to initial access and execution. The requirement for authentication places this within the context of valid accounts being compromised or abused, which relates to techniques such as Valid Accounts (T1078). Once inside, the exploitation of command injection facilitates Remote Command Execution (T1059), allowing the attacker to run arbitrary scripts or binaries on the system. This can subsequently lead to persistence mechanisms like Systemd Service Creation (T1543) or scheduled task creation if the attacker seeks long-term control. Understanding these mappings helps security teams prioritize detection rules and incident response procedures, focusing on monitoring for unusual command executions originating from RPC services and validating that all software components are kept up-to-date with vendor-provided patches to close known exploitation paths.