CVE-2026-56115

Name of the Vulnerable Software and Affected Versions Bootimus versions 0.1.0 through 0.1.70 dhcpcd versions 1.0 through 10.3.2

Description Bootimus contains a broken access control issue where the JWTMiddleware() function in internal/auth/auth.go fails to inspect the is admin flag. This allows authenticated low-privileged users to perform administrative actions via any endpoint under the /api/users path, such as creating new administrator accounts or resetting administrator passwords, leading to full server control and the ability to modify boot menus and installation scripts for PXE clients.

dhcpcd contains a one-byte stack out-of-bounds write in the dhcp6 makemessage() function in src/dhcp6.c. An unauthenticated attacker on the same link can trigger this by sending a crafted DHCPv6 ADVERTISE message with an IA PD IAPREFIX /0 and an oversized RFC6603 OPTION PD EXCLUDE option body using an exclude prefix length between /121 and /128, potentially corrupting adjacent stack memory.

Recommendations For Bootimus versions 0.1.0 through 0.1.70, restrict access to the /api/users endpoint to prevent unauthorized administrative actions. For dhcpcd versions 1.0 through 10.3.2, apply the fix provided in commit 2f00c7b.