{"id":"CVE-2026-126781","kind":"vulnerability","aliases":["CVE-2026-126781"],"related":[],"title":"Webmin: certificate form lets logged-in users inject root account entries","description":"Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.","summary":"Webmin through version 2.670 does not validate certificate DN fields in acl/cert_issue.cgi, so newline characters can be written into the Webmin users file. An authenticated user can add a second root entry with a known password hash and gain full Webmin root access after miniserv restarts.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","other","self-hosted","webmin"],"not_affected_if":["no-webmin","webmin-login-restricted-to-admins"],"how_to_check":"- Check the installed Webmin version (`webmin --version` or the version shown in the Webmin UI) and compare it with the fixed release in the sources.\n- Review which Webmin accounts exist and whether any unexpected root-level entries appear in the Webmin users file.","fix":"- Webmin: unknown (the sources give patch links on github.com but do not state the fixed version number in the provided text)","status":"open","published_at":"2026-11-11T19:17:39+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","triaged_at":"2026-11-11T19:30:00+00:00","updated_at":"2026-11-11T19:30:00+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T19:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- Webmin: unknown (the sources give patch links on github.com but do not state the fixed version number in the provided text)","reach":"network","title":"Webmin: certificate form lets logged-in users inject root account entries","impact":"high","summary":"Webmin through version 2.670 does not validate certificate DN fields in acl/cert_issue.cgi, so newline characters can be written into the Webmin users file. An authenticated user can add a second root entry with a known password hash and gain full Webmin root access after miniserv restarts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["webmin","self-hosted","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user gains root access to the Webmin server","analyst_note":"Confirm the fixed Webmin version from the github.com patch links and the vulncheck advisory.","how_to_check":"- Check the installed Webmin version (`webmin --version` or the version shown in the Webmin UI) and compare it with the fixed release in the sources.\n- Review which Webmin accounts exist and whether any unexpected root-level entries appear in the Webmin users file.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-webmin","webmin-login-restricted-to-admins"],"who_is_affected":"Any server running Webmin through 2.670 where users can log in to Webmin, since the flaw requires an authenticated Webmin user to submit the certificate form. Servers without Webmin, or where Webmin login is restricted to trusted administrators only, carry less exposure but should still be patched.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000762,"input_tokens":4629,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126781':15A,18A '-2026':14A,17A '2.670':28B,73C 'access':67B,123C 'account':11A 'acl/cert_issue.cgi':36B,81C 'add':52B,110C 'allow':83C 'attack':98C 'authent':49B,84C 'backslash':106C 'certif':2A,32B,93C 'charact':39B 'contain':74C,96C 'cve':13A,16A 'dn':33B,94C,102C 'end':100C 'entri':12A,56B,114C 'field':34B,95C,103C 'file':47B,77C 'form':3A 'full':64B 'gain':63B,120C 'hash':61B,119C 'host':23B 'inject':9A,78C,88C 'known':59B,117C 'let':4A 'line':89C 'linux':19B 'log':6A 'logged-in':5A 'miniserv':69B,125C 'newlin':38B,97C,108C 'password':60B,118C 'restart':70B,126C 'root':10A,55B,66B,113C,122C 'second':54B,112C 'self':22B 'self-host':21B 'suppli':91C 'unvalid':92C 'user':8A,46B,50B,76C,86C 'valid':31B 'version':27B 'vulner':79C 'webmin':1A,24B,25B,45B,65B,71C,85C,121C 'written':42B","nicknames":[],"mitigations":[],"who_affected":"Any server running Webmin through 2.670 where users can log in to Webmin, since the flaw requires an authenticated Webmin user to submit the certificate form. Servers without Webmin, or where Webmin login is restricted to trusted administrators only, carry less exposure but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","other","selfhosted","webmin"],"campaign_type":null,"search_a":"'-126781':15A,18A '-2026':14A,17A 'account':11A 'certif':2A 'cve':13A,16A 'entri':12A 'form':3A 'inject':9A 'let':4A 'log':6A 'logged-in':5A 'root':10A 'user':8A 'webmin':1A","search_b":"'2.670':28B 'access':67B 'acl/cert_issue.cgi':36B 'add':52B 'authent':49B 'certif':32B 'charact':39B 'dn':33B 'entri':56B 'field':34B 'file':47B 'full':64B 'gain':63B 'hash':61B 'host':23B 'known':59B 'linux':19B 'miniserv':69B 'newlin':38B 'password':60B 'restart':70B 'root':55B,66B 'second':54B 'self':22B 'self-host':21B 'user':46B,50B 'valid':31B 'version':27B 'webmin':24B,25B,45B,65B 'written':42B","search_c":"'2.670':73C 'access':123C 'acl/cert_issue.cgi':81C 'add':110C 'allow':83C 'attack':98C 'authent':84C 'backslash':106C 'certif':93C 'contain':74C,96C 'dn':94C,102C 'end':100C 'entri':114C 'field':95C,103C 'file':77C 'gain':120C 'hash':119C 'inject':78C,88C 'known':117C 'line':89C 'miniserv':125C 'newlin':97C,108C 'password':118C 'restart':126C 'root':113C,122C 'second':112C 'suppli':91C 'unvalid':92C 'user':76C,86C 'vulner':79C 'webmin':71C,85C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126781","severity":null,"published_at":"2026-11-11T19:17:39+00:00","modified_at":"2026-11-11T19:17:39+00:00","first_seen_at":"2026-11-11T19:28:47+00:00","fetched_at":"2026-11-11T19:28:47+00:00","note":null}],"documents":[{"id":128130,"url":"https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128131,"url":"https://github.com/webmin/webmin/commit/8fb194e5fbc30a6664545d48940d03759ace9bf2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128132,"url":"https://www.vulncheck.com/advisories/webmin-through-2.670-users-file-injection-via-acl-cert-issue-cgi","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}