CVE-2026-72842 in LuCI
Summary
by MITRE • 08/14/2026
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The luci-app-lxc vulnerability represents a critical access control flaw that undermines the security boundaries between low-privileged users and the underlying system resources. This issue exists within the OpenWrt web-based management interface, specifically in how the application handles authentication checks for container management operations. The vulnerability stems from an ACL inconsistency where the system fails to properly validate user permissions before granting access to backend container management routes, creating a path for unauthorized privilege escalation.
The technical exploitation of this vulnerability relies on path traversal techniques using the encoded sequence `/.%2E` within the `lxc_name` parameter. This specific encoding bypasses directory validation mechanisms by exploiting how the system interprets URL-encoded characters during path resolution. The flaw allows attackers to traverse beyond the intended container directories and access host-side resources that should remain restricted. When combined with the `lxc.hook.start-host` execution mechanism, this vulnerability creates a direct pathway for arbitrary code execution with root privileges on the OpenWrt host system.
The operational impact of this vulnerability extends far beyond simple privilege escalation, as it fundamentally compromises the containerization security model implemented by luci-app-lxc. Attackers can leverage this flaw to execute malicious scripts with elevated privileges, potentially leading to complete system compromise. The vulnerability affects all systems running affected versions of OpenWrt with luci-app-lxc installed, making it particularly dangerous in environments where multiple users have access to the web interface.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software applications. The flaw also maps to ATT&CK technique T1068, which covers "Exploitation for Privilege Escalation" and T1059, covering "Command and Scripting Interpreter" as attackers can execute commands through the container hooks mechanism. Security practitioners should note that this vulnerability demonstrates how web application interfaces can bypass container isolation boundaries when proper input validation and access control checks are missing.
The recommended mitigation strategies include immediate patching of affected OpenWrt versions, implementing additional input validation for all path parameters, and strengthening ACL enforcement mechanisms within the Luci interface. Organizations should also consider implementing network segmentation to limit access to management interfaces and conduct regular security audits of web-based administrative tools. Additional protective measures include monitoring for suspicious path traversal attempts in system logs and implementing proper privilege separation between user-facing interfaces and host-level operations.
The vulnerability highlights the importance of comprehensive security testing for web interfaces that interact with containerization systems, particularly in embedded environments where resource constraints may lead to incomplete security implementations. Regular security assessments should focus on input validation, access control enforcement, and privilege boundaries within management applications to prevent similar issues from arising in other software components.