CVE-2026-79920

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16

Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring plugin-management authorization. The InstallPlugin and UnAllPlugin functions create a pip package specification using unvalidated name and version fields. Because the task worker executes pip with root privileges, a low-privileged user can manipulate package installations to execute arbitrary code as root, leading to full host compromise.

Recommendations Update Ajenti to version 2.2.16.