CVE-2026-69096 in luci-app-dockerman
Summary
by MITRE • 08/03/2026
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the OpenWrt luci-app-dockerman package where the ucode docker_rpc.uc RPC backend contains a critical OS command injection flaw that can be exploited by authenticated users with read privileges. The issue stems from the package's access control configuration which grants broad ubus permissions to docker. and docker.container. namespaces, inadvertently exposing the docker.container.ttyd_start method despite its mutating nature. This method serves as the attack vector because it constructs shell commands dynamically using request-controlled parameters including id, cmd, and uid fields without proper input sanitization or command escaping mechanisms.
The technical exploitation occurs within the run_ttyd handler function where user-controllable data is directly incorporated into system() calls without proper shell argument quoting or argv-style execution methods. When an authenticated attacker with read ACL access to luci-app-dockerman submits a malicious HTTP POST request to the /ubus endpoint, they can inject shell metacharacters through the id parameter, effectively bypassing normal security boundaries. The vulnerability operates in the rpcd root context, meaning successful exploitation results in arbitrary command execution with root privileges. This represents a privilege escalation vulnerability that transforms limited read access into full system compromise.
The operational impact of this vulnerability is severe as it allows attackers to execute arbitrary code with the highest system privileges available within the OpenWrt environment. The affected versions include LuCI master and openwrt-25.12 snapshots containing the problematic ucode docker_rpc.uc backend, while older stable releases openwrt-24.10 and openwrt-23.05 remain unaffected as they do not contain this specific backend implementation. From a cybersecurity perspective, this vulnerability aligns with CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: Unix Shell), representing a critical entry point for attackers seeking persistent access or system control. The vulnerability demonstrates poor input validation practices and improper privilege separation within the web application framework, creating an attack surface that should have been restricted to prevent command execution capabilities from being exposed to read-only authenticated users.
Organizations using affected OpenWrt versions should immediately implement mitigations including restricting ubus access permissions for docker.container.* methods, implementing proper input sanitization for all user-controllable parameters, and applying the latest security patches once available. Network segmentation and monitoring of /ubus endpoint access patterns can help detect exploitation attempts. The vulnerability highlights the importance of least privilege principles in web application design and demonstrates how seemingly minor access control misconfigurations can create critical security risks when combined with improper input handling in system-level functions.