CVE-2026-126781 · Other
NO FIX YET · SEE WHAT TO DO
Webmin through version 2.670 does not validate certificate DN fields in acl/cert_issue.cgi, so newline characters can be written into the Webmin users file. An authenticated user can add a second root entry with a known password hash and gain full Webmin root access after miniserv restarts.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any server running Webmin through 2.670 where users can log in to Webmin, since the flaw requires an authenticated Webmin user to submit the certificate form. Servers without Webmin, or where Webmin login is restricted to trusted administrators only, carry less exposure but should still be patched.
Not affected if no-webmin, webmin-login-restricted-to-admins
Who cares linux, self-hosted, webmin
webmin --version or the version shown in the Webmin UI) and compare it with the fixed release in the sources.Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.