CVE-2026-72840 openwrt CVE debrief

Who should care

OpenWrt LuCI administrators and users with mount-configuration ACL group membership should assess exposure and verify ACL group membership. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and plan for remediation or compensating controls as necessary.

Why it matters

CVE-2026-72840 allows authenticated users with mount-configuration ACL group to append arbitrary cron entries, potentially leading to unauthorized code execution as root.

• Authenticated users can append arbitrary cron entries, potentially leading to unauthorized code execution as root.
• Default busybox crond daemon executes cron entries as root within one minute.
• Verification of ACL group membership and cron entry modifications is necessary.
• Remediation priority is high due to potential for unauthorized code execution.

Technical summary

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts, granting write access to /etc/crontabs/root to users intended only for mount configuration. This vulnerability allows authenticated users with mount-configuration ACL group to append arbitrary cron entries via ubus file.write, potentially leading to unauthorized code execution as root within one minute by the default busybox crond daemon. Immediate assessment and remediation are recommended for OpenWrt LuCI deployments to prevent potential unauthorized code execution.

Defensive priority

High-priority assessment and remediation recommended for OpenWrt LuCI deployments.

Recommended defensive actions

• Assess OpenWrt LuCI deployments for exposure to CVE-2026-72840
• Verify and restrict ACL group membership for mount configuration
• Monitor for and respond to potential cron entry modifications
• Apply vendor remediation when available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the overly permissive ACL definition in luci-mod-system-mounts. Evidence limits suggest that OpenWrt LuCI deployments should be assessed for exposure to CVE-2026-72840, verifying ACL group membership and monitoring for potential cron entry modifications. Defenders should verify affected scope and validate vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.