CVE-2026-57200: Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the Asterisk REST Interface (ARI) may, under certain conditions, execute write operations through REST-over-WebSocket. The authorization bypass permits arbitrary module path loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Exposure requires the Asterisk HTTP web server to be enabled and reachable, plus valid read-only ARI credentials. HTTP is disabled by default and, when enabled, binds to 127.0.0.1 by default, so instances retaining those defaults are not remotely reachable through the HTTP service.
What does an attacker need to exploit this issue?
An attacker needs valid credentials that have read-only permissions for the Asterisk REST Interface (ARI). Exploitation also depends on the HTTP web server being enabled and reachable, and succeeds only under certain conditions.
Can read-only ARI access lead to code execution?
Yes. The REST-over-WebSocket authorization bypass can allow write operations despite read-only ARI permissions, including loading an arbitrary module path; this can conditionally result in remote code execution.
What versions contain the fix?
The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 22.8-cert3.
What can be done if updating immediately is not possible?
Disable the Asterisk HTTP web server if it is not required. If it must remain enabled, ensure it is not reachable by untrusted parties and restrict access to valid ARI credentials, particularly accounts granted read-only ARI permissions.