Which versions of luci-app-dockerman are affected by EUVD-2026-52289?

OpenWrt routers running LuCI master or openwrt-25.12 snapshots contain a command injection vulnerability that allows read-only administrators to gain full root control.. A patch is available.

How to fix or mitigate EUVD-2026-52289?

Within 24 hours, audit your environment to identify all OpenWrt routers running LuCI master or openwrt-25.12 snapshots after the JavaScript-to-ucode backend conversion, document their network exposure, and review administrative access logs. Within 7 days, establish monitoring of OpenWrt security advisories for patched snapshot releases and stage deployment procedures. Within 30 days, apply patches to all affected routers and implement network segmentation restricting LuCI interface access to designated administrative networks.

luci-app-dockerman EUVD-2026-52289

Q: What is the CVSS score of EUVD-2026-52289?

EUVD-2026-52289 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

| CVE-2026-69096 HIGH

OS Command Injection (CWE-78)

2026-08-03 VulnCheck

GHSA-wjfh-jfr9-fxvm

Docker Command Injection Luci

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible ubus endpoint, low-complexity injection; PR:L because a valid read-ACL account is required; rpcd already runs as root so no scope change beyond the device itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 03, 2026 - 14:22 vuln.today

Analysis Generated

Aug 03, 2026 - 14:22 vuln.today

CVE Published

Aug 03, 2026 - 13:20 cve.org

HIGH 8.7

DescriptionCVE.org

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

AnalysisAI

OS command injection in OpenWrt's luci-app-dockerman grants any authenticated user holding only the read ACL full root-level code execution on the affected router. The vulnerable run_ttyd handler in the ucode docker_rpc.uc backend constructs a shell command from attacker-controlled request fields (id, cmd, uid) and passes them unsanitized to system() within the rpcd root context, reachable via a simple HTTP POST to /ubus. Only LuCI master and openwrt-25.12 snapshots after the JS-to-ucode backend conversion are affected; upstream patch commits exist but no released patched snapshot version was confirmed as of the advisory, and no public exploit is identified at time of analysis.

Technical ContextAI

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) within the ucode-based docker_rpc.uc RPC backend, introduced when OpenWrt LuCI migrated its Docker management interface from JavaScript to ucode. The docker.container.ttyd_start ubus method invokes the run_ttyd handler, which assembles a shell command string by concatenating the request-supplied id, cmd, and uid fields without quoting or using argv-style execution, then hands the result directly to system() - running in the rpcd daemon process, which executes as root. A compounding design flaw is that the package's read ACL grants broad access to the docker.* and docker.container.* ubus namespaces, inadvertently exposing this mutating method to users who were intended to have only read visibility. The affected CPE is cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*, with EUVD identifying build luci 26.162.29621~507ab5e as a confirmed vulnerable snapshot.

RemediationAI

Upstream fix commits are available at https://github.com/openwrt/luci/commit/f4d0a44950e42bcbb8eacf715a3493b276a4f3ac and https://github.com/openwrt/luci/commit/44618b5b53d9bdad5cd489e82e29688b4d0862c1; however, no tagged or officially released patched snapshot build was confirmed as of the advisory date, so operators should monitor the advisory at https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv for a fixed build. As an immediate compensating control, removing the luci-app-dockerman package entirely eliminates the attack surface if LuCI-based Docker management is not operationally required - this does not affect Docker daemon functionality itself, only the LuCI UI integration. If the package must remain installed, revoke or restrict the luci-app-dockerman read ACL from all non-administrator accounts via the rpcd ACL configuration in /usr/share/rpcd/acl.d/; the trade-off is that those accounts will lose Docker status visibility through the LuCI interface. Additionally, restricting network access to the LuCI web interface (TCP 80/443) to trusted management subnets reduces exposure to opportunistic attackers but does not mitigate insider or compromised-credential scenarios.