CVE-2026-26899: OpenWrt vulnerability
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated user of the affected OpenWrt LuCI HTTPS DNS Proxy interface or RPC endpoint. The issue is therefore most relevant where untrusted or lower-privileged users can authenticate to the device.
What access is required to execute commands?
The attacker needs to supply shell metacharacters through the name parameter handled by setInitAction in /usr/libexec/rpcd/luci.https-dns-proxy. Successful exploitation allows arbitrary shell command execution.
Which releases are affected?
The issue is described as affecting luci-app-https-dns-proxy versions before 2026-01-17, associated with OpenWrt pull request #15. No specific OpenWrt firmware version range is provided.