---
id: "CVE-2026-116778"
kind: "vulnerability"
aliases: ["CVE-2026-116778"]
title: "FOG: API user can edit storage node fields and run commands as root"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fog", "imaging", "linux", "package", "self-hosted", "storage-replication"]
not_affected_if: ["no-api-users-below-admin", "no-storage-node", "no-storage-replication"]
published_at: "2026-10-28T16:17:06+00:00"
first_seen_at: "2026-10-28T16:33:49+00:00"
updated_at: "2026-10-28T16:35:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116778", "first_seen_at": "2026-10-28T16:33:49+00:00"}]
---

# FOG: API user can edit storage node fields and run commands as root

FOG's storage node API accepts edits from a low-privileged API user because it checks credentials but not the administrator role. The edited user, password and ftppath values are later placed into an lftp command that the root-running FOGImageReplicator service executes, so the attacker runs commands as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FOG version against `1.5.10.2253` and `1.6.0-RC-1`.
- Check whether storage replication is enabled and a Storage Node is configured in the FOG web UI.
- Check for API users with `uType=1` and review which of them hold API tokens.

## Fix

- Upgrade FOG to `1.5.10.2253` or `1.6.0-RC-1` or later.
- Rotate the global FOG API token and the user API tokens after upgrading.
- Review Storage Node user and ftppath values for unexpected changes.

## Timeline

- 2026-10-28T16:33:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116778

## From the sources

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_