Live › vulnerability › CVE-2026-116778
Go to dashboardFOG's storage node API accepts edits from a low-privileged API user because it checks credentials but not the administrator role. The edited user, password and ftppath values are later placed into an lftp command that the root-running FOGImageReplicator service executes, so the attacker runs commands as root.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Installations that run FOG with storage replication enabled and at least one usable Storage Node, and that have API-enabled non-administrator users who hold API tokens. Installations without replication or without API-enabled low-privileged users are less exposed, but upgrading is still the fix.
No product ranges from the sources yet.
1.5.10.2253 and 1.6.0-RC-1.uType=1 and review which of them hold API tokens.1.5.10.2253 or 1.6.0-RC-1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116778")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.