What is the CVSS score of CVE-2026-52102?

CVE-2026-52102 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of OpenMediaVault are affected by CVE-2026-52102?

OpenMediaVault NAS appliances running v8.0.4-1 are vulnerable to complete system compromise; publicly available exploit code exists for a critical RAID management plugin flaw that grants root-level…

How to fix or mitigate CVE-2026-52102?

Within 24 hours, identify all OpenMediaVault deployments running v8.0.4-1 or earlier and disable the mdadm RAID management plugin via system settings if active RAID monitoring is not required, immediately eliminating the attack vector. Within 7 days, implement network isolation by restricting management interface access (HTTP/HTTPS on ports 80/443) to a dedicated administrative VLAN using firewall rules, and collect and review access logs for signs of exploitation attempts. Within 30 days, upgrade to OpenMediaVault v8.0.5 or later once vendor patches are released; if upgrades cannot be performed, deploy an authentication proxy (nginx with LDAP/OIDC) in front of the management interface as an architectural mitigation, and verify remediation through security testing.

OpenMediaVault CVE-2026-52102

EUVD-2026-52482 CRITICAL

OS Command Injection (CWE-78)

2026-08-03 mitre

GHSA-8hcw-9fqg-x86g

Command Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable low-complexity injection, but OMV's RAID plugin sits behind the authenticated admin panel, so PR:L; root execution gives full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:40 vuln.today

CVSS changed

Aug 06, 2026 - 22:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.

AnalysisAI

Root-level OS command injection in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 lets attackers inject shell metacharacters into a parameter that is passed unsanitized to a system command, yielding arbitrary command execution as root. OpenMediaVault is a Debian-based network-attached-storage (NAS) management platform, and the -md plugin manages Linux mdadm software RAID arrays. Publicly available exploit code exists (a proof-of-concept gist is referenced), though there is no public exploit identified in CISA KEV; EPSS is modest at 0.62% (46th percentile).

Technical ContextAI

OpenMediaVault is an open-source NAS solution built on Debian that exposes a PHP/backend-driven web administration interface; the openmediavault-md plugin adds management of software RAID via the underlying mdadm toolchain. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controllable input (for example a device name or RAID parameter) is concatenated into a shell command executed by the OMV backend daemon, which runs with root privileges. Because shell metacharacters (such as ;, |, `, $()) are not neutralized, an attacker can break out of the intended command context and append arbitrary commands. The CPE data in the feed is a placeholder (cpe:2.3:a:n/a:n/a) and provides no usable product/version identifiers, so affected-version scoping relies on the description text.

RemediationAI

No vendor-released patched version is identified in the available data, so no fixed release can be cited; monitor the OpenMediaVault project (https://github.com/openmediavault/openmediavault and https://www.openmediavault.org) and upgrade to the first release that supersedes the openmediavault-md plugin in 8.0.4-1 once published. As compensating controls: restrict access to the OMV web administration interface to trusted management networks or a VPN and never expose it to the internet (trade-off: remote admins must connect via VPN); if software RAID management is not required, uninstall or disable the openmediavault-md plugin to remove the vulnerable code path (trade-off: loss of RAID management UI); and enforce strong, unique admin credentials with limited admin accounts to reduce the pool of users who can reach the vulnerable endpoint. Validate any fix against the referenced proof-of-concept at https://gist.github.com/NtGabrielGomes/46817d363821cf8c5ff4882c811a4325.