CVE-2026-79920: Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ajentito a version that resolves this vulnerability.Fixed in 2.2.16 - Compensating control
If unable to upgrade immediately, restrict access to Ajenti’s task-enqueue endpoint /api/core/tasks/start so authenticated users cannot enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization.
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs an authenticated Ajenti account, but it can be a low-privileged account. No plugin-management authorization is required to start the affected tasks.
Which Ajenti versions need to be remediated?
Ajenti versions before 2.2.16 are affected. Version 2.2.16 contains the fix.
What actions can a low-privileged user trigger?
A low-privileged authenticated user can invoke the task-start API to enqueue plugin installation, removal, or upgrade operations. The affected plugin install and uninstall paths invoke pip as root, enabling root-level code execution and full host compromise.