CVE-2026-69096 openwrt CVE debrief

Who should care

OpenWrt users and administrators who have installed the luci-app-dockerman package, especially those with exposed /ubus endpoints, should be aware of this vulnerability and take steps to mitigate it. This includes verifying the presence of luci-app-dockerman in OpenWrt environments, restricting access to the docker_rpc.uc RPC backend, implementing compensating controls to monitor and limit interactions with the /ubus endpoint, and applying vendor remediation when available. Security teams should prioritize monitoring for and responding to potential exploitation attempts due to the high severity of this vulnerability and the potential for authenticated attackers to execute arbitrary commands as root.

Technical summary

The OpenWrt luci-app-dockerman package contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, exposing the docker.container.ttyd_start method. An authenticated attacker can inject shell metacharacters in the id, cmd, and uid fields to execute arbitrary commands as root via an HTTP POST to /ubus. The vulnerability exists due to the run_ttyd handler building a shell command from request-controlled fields and passing it to system() without proper quoting or argv-style execution in the rpcd root context. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.

Defensive priority

Authenticated attackers with the luci-app-dockerman read ACL can inject shell metacharacters to execute arbitrary commands as root via an HTTP POST to /ubus, indicating a high severity vulnerability.

Recommended defensive actions

• Inventory and verify the presence of luci-app-dockerman in OpenWrt environments.
• Restrict access to the docker_rpc.uc RPC backend.
• Implement compensating controls to monitor and limit interactions with the /ubus endpoint.
• Apply vendor remediation when available.
• Monitor for and respond to potential exploitation attempts.

Evidence notes

The vulnerability exists in OpenWrt luci-app-dockerman with an OS command injection vulnerability due to broad ubus access granted by the package's read ACL. The run_ttyd handler builds a shell command from request-controlled fields and passes it to system() without proper quoting.

Official resources