CVE-2026-72603

Name of the Vulnerable Software and Affected Versions wg-easy version 15.3.0

Description An OS command injection issue exists where users with the clients.create permission can execute arbitrary commands as root. This occurs because the client name field is written to the WireGuard configuration file without neutralizing newline characters. An attacker can inject newline-delimited WireGuard PostUp directives, which are then executed by wg-quick with root privileges, leading to root code execution on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.