CVE-2026-72842 openwrt CVE debrief

Who should care

OpenWrt system administrators and users with low-privileged access to LuCI should assess their exposure and take steps to verify and patch affected systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-72842 allows low-privileged LuCI users to access unauthorized container management routes, potentially leading to root code execution via path traversal. Defenders should prioritize verifying and patching affected OpenWrt systems, restricting access to container management routes, and monitoring for suspicious activity.

• Potential root code execution on OpenWrt hosts
• Unauthorized access to container management routes
• Possible lateral movement within OpenWrt systems

Technical summary

The luci-app-lxc package contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. This can be exploited via path traversal using `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, potentially achieving root code execution on the OpenWrt host.

Defensive priority

Defenders should prioritize verifying and patching affected OpenWrt systems, restricting access to container management routes, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and apply patches for luci-app-lxc on OpenWrt systems
• Restrict access to container management routes
• Monitor for suspicious activity and potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the ACL inconsistency vulnerability in luci-app-lxc. Vendor information is limited, with an unknown vendor and low confidence level. The vulnerability allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. This can be exploited via path traversal using `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, potentially achieving root

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.