{"id":"CVE-2026-116778","kind":"vulnerability","aliases":["CVE-2026-116778"],"related":[],"title":"FOG: API user can edit storage node fields and run commands as root","description":"FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.","summary":"FOG's storage node API accepts edits from a low-privileged API user because it checks credentials but not the administrator role. The edited user, password and ftppath values are later placed into an lftp command that the root-running FOGImageReplicator service executes, so the attacker runs commands as root.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fog","imaging","linux","package","self-hosted","storage-replication"],"not_affected_if":["no-api-users-below-admin","no-storage-node","no-storage-replication"],"how_to_check":"- Check the installed FOG version against `1.5.10.2253` and `1.6.0-RC-1`.\n- Check whether storage replication is enabled and a Storage Node is configured in the FOG web UI.\n- Check for API users with `uType=1` and review which of them hold API tokens.","fix":"- Upgrade FOG to `1.5.10.2253` or `1.6.0-RC-1` or later.\n- Rotate the global FOG API token and the user API tokens after upgrading.\n- Review Storage Node user and ftppath values for unexpected changes.","status":"open","published_at":"2026-10-28T16:17:06+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:44+00:00","updated_at":"2026-10-28T16:35:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T16:35:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FOG to `1.5.10.2253` or `1.6.0-RC-1` or later.\n- Rotate the global FOG API token and the user API tokens after upgrading.\n- Review Storage Node user and ftppath values for unexpected changes.","reach":"network","title":"FOG: API user can edit storage node fields and run commands as root","impact":"high","summary":"FOG's storage node API accepts edits from a low-privileged API user because it checks credentials but not the administrator role. The edited user, password and ftppath values are later placed into an lftp command that the root-running FOGImageReplicator service executes, so the attacker runs commands as root.","category":"package","nicknames":[],"who_cares":["fog","self-hosted","linux","imaging","storage-replication"],"confidence":0.8,"needs_auth":"yes","worst_case":"low-privileged API user runs commands as root on server","analyst_note":"","how_to_check":"- Check the installed FOG version against `1.5.10.2253` and `1.6.0-RC-1`.\n- Check whether storage replication is enabled and a Storage Node is configured in the FOG web UI.\n- Check for API users with `uType=1` and review which of them hold API tokens.","needs_analyst":false,"not_affected_if":["no-storage-replication","no-storage-node","no-api-users-below-admin"],"who_is_affected":"Installations that run FOG with storage replication enabled and at least one usable Storage Node, and that have API-enabled non-administrator users who hold API tokens. Installations without replication or without API-enabled low-privileged users are less exposed, but upgrading is still the fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3467,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':99C,201C '-116778':16A,19A '-2026':15A,18A '/edit':128C '/fog/storagenode':126C '1':108C '1.5.10.2253':95C,197C '1.6.0':97C,199C 'accept':35B 'administr':51B,150C 'administrator-on':149C 'allow':180C 'api':2A,34B,42B,103C,115C,121C,140C 'api-en':102C 'attack':77B 'authent':101C 'check':46B 'cloning/imaging/rescue':89C 'command':11A,66B,79B,169C,188C 'credenti':47B,143C 'cve':14A,17A 'edit':5A,36B,54B 'enabl':104C,156C 'enforc':147C 'execut':74B,170C,187C 'field':8A,137C,165C 'fix':194C 'fog':1A,20B,30B,82C,120C 'fogimagerepl':72B,162C 'free':85C 'ftppath':58B,136C 'global':119C 'host':26B 'id':127C 'imag':21B 'interpol':163C 'issu':192C 'later':61B 'lftp':65B,168C 'linux':22B 'low':40B,183C 'low-privileg':39B,182C 'manag':91C 'modifi':130C 'node':7A,33B,132C,161C 'open':87C,173C 'open-sourc':86C 'packag':23B 'pass':134C 'password':56B 'place':62B 'possess':110C 'prior':93C 'privileg':41B,184C 'proc':172C 'put':125C 'rc':98C,200C 'replic':29B,155C 'role':52B,152C 'root':13A,70B,81B,177C,190C 'root-run':69B,176C 'run':10A,71B,78B,178C 'self':25B 'self-host':24B 'servic':73B,179C 'sourc':88C 'storag':6A,28B,32B,131C,154C,160C 'storage-repl':27B 'suite/inventory':90C 'system':92C 'token':116C,122C 'usabl':159C 'use':124C 'user':3A,43B,55B,105C,113C,133C,185C 'utyp':107C 'valid':141C 'valu':59B 'version':196C","nicknames":[],"mitigations":[],"who_affected":"Installations that run FOG with storage replication enabled and at least one usable Storage Node, and that have API-enabled non-administrator users who hold API tokens. Installations without replication or without API-enabled low-privileged users are less exposed, but upgrading is still the fix.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116778","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116778","severity":null,"published_at":"2026-10-28T16:17:06+00:00","modified_at":"2026-10-28T16:17:06+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}