CVE-2026-26899

CVE-2026-26899 is an OS command injection flaw (CWE-78) in the setInitAction function of /usr/libexec/rpcd/luci.https-dns-proxy, the rpcd backend of the luci-app-https-dns-proxy add-on for OpenWrt. An authenticated user who submits a request containing shell metacharacters in the 'name' parameter causes those characters to be interpreted by the shell, resulting in execution of arbitrary commands on the router. A successful attack gives the attacker command execution with the privileges of the rpcd/LuCI service, with high impact on confidentiality, integrity and availability of the device (CVSS 8.8, AV:N/PR:L). Only OpenWrt installations running luci-app-https-dns-proxy built from PR #15 and dated before the 2026-01-17 fix are affected; the app is an optional third-party package, not part of a default OpenWrt install. There is no evidence of exploitation in the wild, no known public proof-of-concept, and EPSS estimates only a 0.5% probability of exploitation within 30 days.

What to do: Update luci-app-https-dns-proxy to a build dated 2026-01-17 or later, which includes the fix for the setInitAction handling of the name parameter. Until then, restrict LuCI/rpcd access to fully trusted, authenticated users only (e.g., limit LuCI exposure to trusted LAN segments, avoid exposing it to the WAN) and review the router for unexpected processes, cron/init changes, or unfamiliar traffic that could indicate injected commands were run.