EUVD-2026-35135
GHSA-w8vj-qcv3-4w36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain OpenBullet2 web credentials
-
DeliveryAuthenticate to job configuration UI
-
ExploitCreate job using plain C# execution mode
-
InstallEmbed arbitrary .NET payload (Process.Start, file I/O)
-
C2Trigger job execution
-
ExecuteAchieve code execution as service user
-
ImpactPivot to host file system and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the OpenBullet2 web interface at any privilege level that can create or modify job configurations (CVSS PR:L), network reachability to the UI (AV:N), and the use of the plain C execution mode for jobs - which is the in-product feature that lacks reference filtering and API restrictions. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the target must be running OpenBullet2 0.3.2 or earlier, the attacker must hold (or obtain via the referenced empty-header auth-bypass technique) a working account, and impact is bounded by the OS-level privileges of the OpenBullet2 process user - running it as a non-root, sandboxed account meaningfully contains post-exploitation. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scoring 8.7 reflects network-reachable, low-complexity exploitation requiring only low-privilege authentication and yielding full confidentiality, integrity, and availability impact on the host - appropriate for an authenticated-RCE primitive. Publicly available exploit code exists per the input, and the referenced HackerNoon piece describes an empty-header authentication bypass that, if applicable to the same deployment, can collapse the PR:L barrier and turn this into pre-auth RCE in practice. The CVE is not listed in CISA KEV and no EPSS score was provided, so widespread mass-exploitation telemetry is not confirmed; however, OpenBullet2's user base (operators running it on exposed VPSs) and the published technique make targeted compromise plausible. Net judgment: this is a real priority for anyone running OpenBullet2 externally, not a paper-only high-CVSS finding. |
| Exploit ScenarioDerived | An attacker obtains low-privilege OpenBullet2 credentials - through reuse, weak defaults, the related auth-bypass technique, or a co-tenant operator account - and logs into the web UI. They create or edit a job using the plain C execution mode and embed a short payload that calls System.Diagnostics.Process.Start to drop and run a reverse shell (or directly read configuration secrets and stored cookies). On the next job execution they gain interactive code execution as the OpenBullet2 service account, with publicly available exploit code lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C
code on the host by abusing the job configuration interface's plain C
execution mode. Because that mode lacks reference filtering or API restrictions, attackers can touch the file system, spawn child processes, and call any .NET API as the OpenBullet2 service account. Publicly available exploit code exists, and the issue was reported by VulnCheck; pairing it with a known authentication bypass route (referenced HackerNoon write-up) materially raises real-world exploitability.
Earlier versions of this analysis (2)
Authenticated remote code execution in OpenBullet2 through 0.3.2 lets any logged-in user run arbitrary C
on the host by abusing the plain C
execution mode exposed through job configuration. The VulnCheck-reported flaw carries publicly available exploit code and CVSS 4.0 score 8.7, and it pairs naturally with a separate header-based auth bypass documented in the cited write-up, effectively lowering the bar to fully unauthenticated takeover in vulnerable deployments. No CISA KEV listing has been observed at time of analysis.
Authenticated remote code execution in OpenBullet2 through 0.3.2 lets any logged-in user run arbitrary C
on the server by crafting or editing job configurations that execute in an unrestricted plain C
mode. The vector was reported by VulnCheck and publicly available exploit code exists, including a writeup describing an auth-bypass primitive (empty header) that can elevate the impact to unauthenticated administrative compromise in vulnerable deployments. CVSS 8.8 (AV:N/AC:L/PR:L) reflects high confidentiality, integrity, and availability impact against the host process.
RemediationAI
No vendor-released patch identified at time of analysis - upgrade to any post-0.3.2 release the maintainers publish that explicitly addresses CWE-94 in the job configuration code path, and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-authenticated-rce-via-job-configuration-interface) for fix coordinates. Until a fix ships, do not expose the OpenBullet2 web UI to the public internet: bind it to localhost and reach it via SSH tunnel or VPN, or place it behind an authenticating reverse proxy with IP allowlisting (trade-off: breaks remote operator workflows). Within the application, restrict who can create or edit job configurations to a single trusted admin account, rotate any shared operator credentials, and run the OpenBullet2 process as a low-privilege user inside a container or sandbox so that successful code injection cannot pivot to the underlying host (trade-off: containerization adds operational overhead). Also review for the empty-header auth bypass behavior described in the HackerNoon writeup, since that turns this authenticated RCE into a pre-auth one if present.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenBullet2 is an open-source web automation and request-replay suite (commonly abused for credential stuffing) built on .NET. CWE-94 (Improper Control of Generation of Code, 'Code Injection') captures the root cause: job configurations accept user-supplied C
that is compiled and executed in-process without an allowlist of namespaces, assemblies, or APIs. Because the runtime is .NET, an attacker's code runs with full access to System.IO, System.Diagnostics.Process, reflection, and P/Invoke - effectively the same trust level as the OpenBullet2 worker. The affected CPE is cpe:2.3:a:openbullet:openbullet2:*:*:*:*:*:*:*:* with all versions up to and including 0.3.2 in scope.
Know when Openbullet2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C
code on the server host by creating or modifying job configurations. Attackers can leverage the plain C
execution mode, which lacks reference filtering or API restrictions, to access the file system, spawn processes, and invoke arbitrary .NET APIs as the process user.
Executive ViewAI
OpenBullet2 versions through 0.3.2 contain a critical remote code execution vulnerability that, combined with publicly available exploit code and known authentication bypass techniques, poses immediate risk to organizations. Successful exploitation enables arbitrary code execution under the service account, leading to potential system compromise, lateral movement, and data exfiltration. The low barrier to exploitation-requiring only publicly disclosed techniques-warrants urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict network access to OpenBullet2 instances and limit administrative interface exposure to known trusted IPs; (2) Disable C
execution mode if operationally feasible; (3) Implement least-privilege service accounts with minimal system permissions; (4) Deploy detection and alerting for unauthorized or suspicious C
job submissions, process spawning, or file system modifications; (5) Require multi-factor authentication on administrative access; (6) Maintain offline backups of critical systems to mitigate data exfiltration or destruction risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Openbullet2
View allAuthentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sen
Remote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusin
Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the
Credential disclosure in OpenBullet2 through 0.3.2 on Windows allows authenticated remote attackers to coerce SMB authen
Exploit-DB