CVE-2026-58000

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58000

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58000.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58000

Aliases

GHSA-pm9w-522m-8rrh

Published

2026-06-29T18:16:04Z

Modified

2026-08-12T16:41:33Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey

Details

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58000.json"
}

References

Affected packages

Git / github.com/openwrt/luci

Affected ranges

Type

GIT

Repo

https://github.com/openwrt/luci

Events

Introduced

Fixed

adc4c2932ec7039a6b7effeace098e5bc46861c6

Fixed

e4ff45ecbc6ad212951815c8c99b2749fbd7de6b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.11.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.11.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58000.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "267937982258194431500600583142452512006",
            "length": 275
        },
        "id": "CVE-2026-58000-2d5eb769",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/po2lmo.c",
            "function": "cmp_index"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "252882516357346457311810025894045084359",
            "length": 1127
        },
        "id": "CVE-2026-58000-32b46624",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/template_lmo.c",
            "function": "lmo_open"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "255246143790764752263468115280959242700",
                "275234442868348779508066300671235586565",
                "298876392605505629757341239582167779991",
                "63648796039497051509190760358021637159",
                "231700784739263284885709230475785353172",
                "171502405075970809609179068254291655255",
                "287659827364578275683106832730264120728",
                "266157800178906047088568469210620396817",
                "139158802025619872971326869115177280153",
                "57761734454291790089904071342416977654",
                "163759932672886758421837429586971512615",
                "152477519193259158422681683620746368844",
                "218832914020503057235009219479145375369",
                "130752406432287234203413602790812398018",
                "134392294334258105636367093923781958156",
                "29678459402679828907192032875888954664",
                "56131625441151105134124795207078958965",
                "333507731538656558476771378169086587368",
                "100717214018980979579795712276017776861",
                "172849280745304616561090909405221781094",
                "189642627781276617987544728430484857630",
                "331833475899029850516628542094478609937",
                "258154515434547042347190663594787994631",
                "68412638862159408427704358339124868530",
                "170348445838925904224600793909725865444"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-58000-52baa28f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/template_lmo.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155277813017274838970720379419811512984",
            "length": 463
        },
        "id": "CVE-2026-58000-60bfa144",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/po2lmo.c",
            "function": "print_index"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "208471392475120797360726447137119308023",
            "length": 2334
        },
        "id": "CVE-2026-58000-6a2c1f50",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/po2lmo.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "99854527991470356483642411122612102541",
            "length": 449
        },
        "id": "CVE-2026-58000-89201183",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/template_lmo.c",
            "function": "lmo_translate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "144561230986071348079710888038481586837",
                "339125119656907809640888407608564846000",
                "287410526688364895184924600398181402190",
                "131867462700297383604664798023786887480",
                "51963820585222883880242408473640046624",
                "109106054087145048045335877668735774706",
                "88777273850834081802722427872979618294",
                "37821001619216981429006372506412560624",
                "286687329754630689033448927948797535047",
                "105168513588748326003621304767299186629",
                "109625128140295335998475811736291577452",
                "192537472347544377635438275961756972045",
                "201160946251054775223105899865214492360",
                "267736853800898291689885267742308071703",
                "39348567944437703246817414919933731774",
                "10972374964793075001928437096335639613",
                "39289353252152317818375452559694585655",
                "325465982018422423636926679534163992473",
                "164212262644259844709738925336606535349",
                "20902898861332164099246445727687163193",
                "116890053089853706614014402158137153346",
                "109188239162747433270995588429230074289",
                "60562335353731525188801747724250614678",
                "296956428085599957339045574956199420853",
                "200494138348440971094632979948358492455",
                "216715586464641420154270664597970839773",
                "167096531428686979130326153209377242183"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-58000-992fab73",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/po2lmo.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "327959622269632693434154866840775274349",
            "length": 416
        },
        "id": "CVE-2026-58000-d86ec311",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openwrt/luci/commit/adc4c2932ec7039a6b7effeace098e5bc46861c6",
        "target": {
            "file": "libs/web/src/template_lmo.c",
            "function": "lmo_find_entry"
        }
    }
]

vanir_signatures_modified

"2026-08-12T16:41:33Z"