CVE-2026-82041: UTMStack < 11.2.16 Missing Authorization via Command WebSocket
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.
Affected Software
Event History
Frequently Asked Questions
Which users and systems are exposed to exploitation?
Any authenticated UTMStack user is able to reach the vulnerable command WebSocket handler regardless of assigned role. Connected monitored endpoints are exposed because commands can be forwarded to any connected agent.
What access does an attacker need?
The attacker needs a valid authenticated UTMStack account. No elevated role or user interaction is required, and the attacker can supply arbitrary operating-system commands through the /command/{hostname} STOMP destination.
How severe is command execution on affected endpoints?
The forwarded commands execute through the endpoint agent, which commonly runs as root or SYSTEM. This can give a low-privileged UTMStack user high-privilege command execution on monitored hosts.
What version addresses the issue?
UTMStack versions before 11.2.16 are affected. Upgrade to version 11.2.16 or later.