Which versions of luci-app-https-dns-proxy are affected by CVE-2026-46368?

A command injection vulnerability in luci-app-https-dns-proxy (CVE-2026-46368, CVSS 8.7) allows authenticated users with specific permissions to execute arbitrary commands as root on affected OpenWrt…

Is there a public PoC exploit available for CVE-2026-46368?

Yes, a public proof-of-concept exploit is available for CVE-2026-46368. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-46368?

Within 24 hours: Inventory all OpenWrt deployments to identify systems with luci-app-https-dns-proxy installed and determine which users hold the luci.https-dns-proxy ACL permission. Within 7 days: Immediately revoke luci.https-dns-proxy ACL permissions from all unnecessary accounts; restrict LuCI access to isolated management networks if operationally feasible. Within 30 days: Monitor OpenWrt security advisories and vendor repositories for a patched version (currently unavailable as of analysis date); evaluate alternative DNS-over-HTTPS solutions without this vulnerability or consider uninstalling the package if not critical to operations.

luci-app-https-dns-proxy CVE-2026-46368

Q: What is the CVSS score of CVE-2026-46368?

CVE-2026-46368 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31836 HIGH

Command Injection (CWE-77)

2026-05-26 VulnCheck

GHSA-crmc-hfvp-6m66

Command Injection Luci App Https Dns Proxy

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:02 vuln.today

CVSS changed

May 26, 2026 - 15:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

luci-app-https-dns-proxy through 2025.12.29-5 - an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default - contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.

AnalysisAI

Authenticated command injection in luci-app-https-dns-proxy through version 2025.12.29-5 allows a low-privileged LuCI user holding the luci.https-dns-proxy ACL permission to execute arbitrary commands as root on OpenWrt devices via shell metacharacters in the 'name' parameter of a ubus RPC call to setInitAction. Publicly available exploit code exists (Exploit-DB 52521, VulnCheck advisory), though EPSS remains low at 0.06% and the package is an optional community add-on not installed by default. Core OpenWrt installations are unaffected; only systems that explicitly opted into this LuCI add-on are at risk.

Technical ContextAI

luci-app-https-dns-proxy is an optional LuCI web UI front-end for the https-dns-proxy package, distributed through the OpenWrt community packages feed and used to manage DNS-over-HTTPS resolvers on OpenWrt routers. The vulnerability is a CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw in the setInitAction function exposed through ubus RPC under the luci.https-dns-proxy namespace. The 'name' parameter is passed into a shell context without proper sanitization or argument quoting, so shell metacharacters such as semicolons, backticks, or command substitution sequences are interpreted by the underlying shell. Because LuCI ubus handlers run with root privileges on OpenWrt's procd/ubus IPC, any injected command inherits root context on the device. CPE cpe:2.3:a:mossdef-org:luci-app-https-dns-proxy confirms the affected package is the community-maintained fork hosted at github.com/stangri/luci-app-https-dns-proxy.

RemediationAI

Upstream fix available via the project repository at https://github.com/stangri/luci-app-https-dns-proxy; a released patched version newer than 2025.12.29-5 is not independently confirmed from the provided data, so administrators should pull the latest release from the community feed (opkg update && opkg upgrade luci-app-https-dns-proxy) once a tagged build above 2025.12.29-5 is published, and verify against the VulnCheck advisory at https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-authenticated-command-injection-via-setinitaction. Until a patched build is available, the most effective compensating control is to uninstall the LuCI add-on (opkg remove luci-app-https-dns-proxy) - the underlying https-dns-proxy daemon continues to function and can still be managed via UCI/CLI, the only loss is the web UI. If the UI must remain, revoke the luci.https-dns-proxy ACL from all non-administrator LuCI roles and ensure the LuCI interface is not exposed to untrusted networks (bind uhttpd to LAN only and firewall WAN access to ports 80/443/uhttpd), accepting the trade-off that remote administration over the internet will no longer work. Also rotate any LuCI credentials that may have been shared with low-trust operators.