https://seclists.org/oss-sec/2026/q3/572: OpenRGB: mote System Compromise via Custom Network Protocol (CVE-2026-59682, CVE-2026-59683, CVE-2026-18794)

Q: Which deployments are most exposed?

Systems running the OpenRGB server daemon are exposed if its TCP protocol is reachable. The reviewed configuration listens on all interfaces at 0.0.0.0:6742 by default, and the observed service configuration runs the daemon with full root privileges.

Q: What level of access does an attacker need?

The report describes the issues as enabling trivial full remote system compromise. Because the affected protocol is a TCP service listening on port 6742, an attacker would need network access to that service.

Q: How can I identify a potentially affected service?

Check whether OpenRGB is being started with the --server option, particularly with a configuration such as /usr/bin/openrgb --server --config /etc/openrgb. Also check whether TCP port 6742 is listening on wildcard address 0.0.0.0 and whether the service runs as root.

Published Aug 25, 2026

Updated

Affected Software

1 affected component

OpenRGB OpenRGB<1.0rc3-hotfix

Frequently Asked Questions

Which deployments are most exposed?

Systems running the OpenRGB server daemon are exposed if its TCP protocol is reachable. The reviewed configuration listens on all interfaces at 0.0.0.0:6742 by default, and the observed service configuration runs the daemon with full root privileges.

What level of access does an attacker need?

The report describes the issues as enabling trivial full remote system compromise. Because the affected protocol is a TCP service listening on port 6742, an attacker would need network access to that service.

How can I identify a potentially affected service?

Check whether OpenRGB is being started with the --server option, particularly with a configuration such as /usr/bin/openrgb --server --config /etc/openrgb. Also check whether TCP port 6742 is listening on wildcard address 0.0.0.0 and whether the service runs as root.