High

OS Command Injection in OpenWrt luci-app-dockerman

IdentifiersCVE-2026-69096CWE-78· Improper Neutralization of Special…

CVE-2026-69096 is an OS command injection vulnerability in OpenWrt LuCI's luci-app-dockerman component, affecting LuCI master and OpenWrt 25.12 snapshots that include the ucode-based docker_rpc.uc RPC backend introduced after the JS-to-ucode conversion. The flaw arises from two conditions: the package's read ACL grants broad ubus access to docker.* and docker.container.*, exposing the docker.container.ttyd_start method despite its mutating behavior; and the run_ttyd handler constructs a shell command from request-controlled id, cmd, and uid parameters and passes that command to system() without safe quoting or argv-style execution. Because the command is executed in the rpcd root context, an authenticated user with only the luci-app-dockerman read ACL can inject shell metacharacters through those fields and achieve arbitrary command execution as root via the ubus HTTP interface. OpenWrt 24.10 and 23.05 are not affected because they do not include the vulnerable backend.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in authenticated remote arbitrary command execution with root privileges on the affected device. This enables full compromise of confidentiality, integrity, and availability, including reading or modifying system and container data, altering device configuration, installing persistent payloads, pivoting to other systems reachable from the device, and disrupting services or rendering the device unstable or unusable.

Mitigation

If you can’t patch tonight, do this now.

Until a patch is available, remove or disable luci-app-dockerman or the vulnerable docker_rpc.uc backend where operationally feasible. Restrict access to the ubus HTTP interface to trusted administrators only, and remove or tightly limit the luci-app-dockerman read ACL for non-administrative users. Where possible, segment management access, require strong authentication for LuCI and ubus-exposed services, and monitor for unexpected use of docker-related ubus methods from low-privilege accounts.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed release once one is available. A proper fix should remove the unsafe shell construction in the run_ttyd handler by avoiding system()-based command execution with untrusted input, using argv-style execution or equivalent safe process invocation, and enforcing strict validation of user-supplied parameters. The exposed ubus permissions should also be corrected so that mutating methods such as docker.container.ttyd_start are not reachable through overly broad read ACLs. If maintaining a custom build, backport the upstream fix for the docker_rpc.uc backend and the associated ACL changes.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OpenwrtLuci-App-Dockermanapplication

OpenwrtOpenwrtapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cvefeed high severityNews

Aug 3, 2026

CVE-2026-69096 - OpenWrt luci-app-dockerman Read ACL Remote Code Execution

An OS command injection vulnerability in OpenWrt luci-app-dockerman's ucode docker_rpc.uc RPC backend that allows an authenticated attacker with only the read ACL to execute arbitrary commands as root via /ubus.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1