luci-app-tailscale-community CVE-2026-57999

Q: What is the CVSS score of CVE-2026-57999?

CVE-2026-57999 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-40171 HIGH

OS Command Injection (CWE-78)

2026-06-29 VulnCheck

GHSA-qr7m-7592-rcvx

Command Injection Openwrt Luci

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable RPC needs a low-privilege LuCI login (PR:L), injection is straightforward (AC:L), and root command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 29, 2026 - 19:22 cve.org

HIGH 7.7

Analysis Generated

Jun 29, 2026 - 19:21 vuln.today

DescriptionCVE.org

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the outer shell before argument processing.

AnalysisAI

Authenticated root command injection in the OpenWrt LuCI community Tailscale app (luci-app-tailscale-community) lets a logged-in web UI user run arbitrary OS commands as root through the tailscale.do_login RPC method. Because the user-supplied loginserver and loginserver_authkey values are placed inside a double-quoted shell string, $() and backtick substitutions are evaluated by the outer shell, turning configuration input into command execution. Reported by VulnCheck with a published GHSA advisory; no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

LuCI is the web management interface for OpenWrt routers, and this is a community-maintained add-on that integrates the Tailscale mesh VPN. LuCI exposes server-side actions via rpcd RPC methods that execute under root on the device. The flaw is a classic CWE-78 OS Command Injection: the do_login handler builds a shell command by interpolating attacker-controllable loginserver and loginserver_authkey parameters into a double-quoted string, where the shell still performs command substitution ($(...) and backticks) before tailscale ever parses its arguments, so quoting at the argument level does not stop the outer shell from executing injected commands.

RemediationAI

Patch available per vendor advisory - upgrade luci-app-tailscale-community to the fixed release described in GHSA-xwc5-mx58-rh35 (https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35); the exact fixed version is not stated in the available data and should be confirmed from that advisory and the VulnCheck writeup (https://www.vulncheck.com/advisories/luci-app-tailscale-community-command-injection-via-tailscale-do-login-rpc). Until patched, remove or disable the luci-app-tailscale-community package so the tailscale.do_login RPC is no longer exposed (trade-off: loses web-UI Tailscale management, though the CLI tailscale up still works), and restrict LuCI access to trusted administrators by limiting accounts and binding the web interface to the LAN/management network rather than any WAN or Tailscale-exposed interface (trade-off: remote admins must use a VPN or jump host). Avoid granting LuCI logins to lower-trust users, since any authenticated account can reach the vulnerable RPC.