CVE-2026-69096

Name of the Vulnerable Software and Affected Versions luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend)

Description An OS command injection issue exists where the read ACL grants broad ubus access to docker.* and docker.container.*, exposing the docker.container.ttyd start method. The run ttyd handler constructs a shell command using the id, cmd, and uid variables from the request and passes it to the system() function without proper quoting or argv-style execution in the rpcd root context. An authenticated attacker with read ACL permissions can inject shell metacharacters into these variables, such as id, to execute arbitrary commands as root via an HTTP POST request to the /ubus endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.