luci-app-tailscale-community EUVD-2026-40171

Exploitation requires an authenticated LuCI account (PR:L) on a device running the luci-app-tailscale-community package, and the attacker must invoke the tailscale.do_login RPC method while supplying a malicious value in the loginserver or loginserver_authkey parameter containing a shell substitution like $(...) or backticks. The limiting factors are: valid (even low-privilege) web-UI credentials are mandatory, the vulnerable Tailscale community app must be installed and reachable, and the login/RPC flow must be exercised (reflected by the AT:P attack requirement); no victim user interaction is needed (UI:N). It is not exploitable remotely without authentication.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, score 7.7) describes a network-reachable, low-complexity flaw that nonetheless requires an existing low-privilege authenticated session (PR:L) and carries an attack requirement (AT:P), meaning the attacker must already hold valid LuCI credentials and reach the Tailscale login flow. Impact is severe - full confidentiality, integrity, and availability loss (VC/VI/VA:H) via root command execution on the router. No EPSS score, KEV listing, or known public POC is present in the provided data, so this is a high-impact but not currently mass-exploited issue: real risk concentrates on devices where untrusted or lower-trust users hold LuCI accounts. The PR:L requirement and niche deployment footprint substantially temper the network attack vector, making this a privilege-escalation-to-root concern rather than an unauthenticated internet-wide risk.

A user with low-privilege LuCI credentials (for example a guest or delegated admin account on a shared OpenWrt router) opens the Tailscale login action and supplies a crafted loginserver value containing a substitution such as $(id>/tmp/x) or a reverse shell. When do_login builds and runs the command as root, the injected substitution executes, granting root command execution on the device. No public POC is identified in the provided data, but the low complexity makes weaponization straightforward once credentials are held.