CVE-2026-126781: Webmin through 2.670 Users File Injection via acl/cert_issue.cgi
Webmin through 2.670 contains a users file injection vulnerability in acl/certissue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated as a Webmin user and be able to supply certificate distinguished-name fields to acl/cert_issue.cgi. The attack is network-reachable and does not require user interaction.
What conditions are required to obtain Webmin root access?
The attacker injects an additional root entry with a known password hash by placing a backslash and newline in an unvalidated certificate DN field. Webmin root access is obtained after miniserv restarts.
How can I determine whether an instance may have been compromised?
Inspect the Webmin users file for unexpected additional root entries, particularly entries containing password hashes not authorized by administrators. Review certificate DN input activity and miniserv restart events for suspicious timing.