CVE-2026-116778: FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through procopen() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOGto a version that resolves this vulnerability.Fixed in 1.5.10.2253
Event History
Frequently Asked Questions
Which deployments are exposed to root-level command execution?
Affected deployments are FOG versions before 1.5.10.2253 and 1.6.0-RC-1 where storage replication is enabled and a usable Storage Node is available. The root-running FOGImageReplicator service is the component that executes the injected command.
What access does an attacker need?
An attacker needs an authenticated API-enabled FOG user with uType=1, that user's API token, and the global FOG API token. No user interaction is required.
What should be prioritized for remediation?
Upgrade to FOG 1.5.10.2253 or 1.6.0-RC-1. If upgrading cannot happen immediately, disabling storage replication removes the stated condition required to reach the root-running replication path.
How can defenders assess whether the vulnerable path is available?
Check whether the installation is running a version earlier than 1.5.10.2253 or 1.6.0-RC-1, whether storage replication is enabled, and whether a usable Storage Node exists. Also identify API-enabled uType=1 accounts and protect both user API tokens and the global FOG API token.