{"id":"CVE-2026-57203","kind":"vulnerability","aliases":["CVE-2026-57203"],"related":[],"title":"Asterisk: ast_loggrabber runs a script planted in world-writable /tmp","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"The ast_loggrabber tool in Asterisk runs a Python script taken from the world-writable /tmp directory. A local user who already has a shell on the server can plant a malicious script there and gain elevated privileges when an administrator runs the tool.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","linux","runtime","self-hosted","telephony"],"not_affected_if":["ast_loggrabber-unused","no-local-shell-users"],"how_to_check":"- Check the installed Asterisk version with `asterisk -V` and compare it to the fixed releases listed below.\n- Check whether `ast_loggrabber` is present and who runs it, for example with `which ast_loggrabber` and by reviewing sudo rules.","fix":"- Upgrade Asterisk 20 to `20.20.1` or later, Asterisk 21 to `21.12.3` or later, Asterisk 22 to `22.10.1` or later, and Asterisk 23 to `23.4.1` or later.\n- Upgrade Certified Asterisk 20.7 to `20.7-cert11` or later and Certified Asterisk 22.8 to `22.8-cert3` or later.","status":"open","published_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","triaged_at":"2026-10-27T22:30:17+00:00","updated_at":"2026-10-27T22:30:17+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-27T22:30:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk 20 to `20.20.1` or later, Asterisk 21 to `21.12.3` or later, Asterisk 22 to `22.10.1` or later, and Asterisk 23 to `23.4.1` or later.\n- Upgrade Certified Asterisk 20.7 to `20.7-cert11` or later and Certified Asterisk 22.8 to `22.8-cert3` or later.","reach":"local","title":"Asterisk: ast_loggrabber runs a script planted in world-writable /tmp","impact":"high","summary":"The ast_loggrabber tool in Asterisk runs a Python script taken from the world-writable /tmp directory. A local user who already has a shell on the server can plant a malicious script there and gain elevated privileges when an administrator runs the tool.","category":"runtime","nicknames":[],"who_cares":["asterisk","telephony","self-hosted","linux"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains root by planting a script in /tmp","analyst_note":"","how_to_check":"- Check the installed Asterisk version with `asterisk -V` and compare it to the fixed releases listed below.\n- Check whether `ast_loggrabber` is present and who runs it, for example with `which ast_loggrabber` and by reviewing sudo rules.","needs_analyst":false,"not_affected_if":["no-local-shell-users","ast_loggrabber-unused"],"who_is_affected":"Servers running affected Asterisk releases where someone runs ast_loggrabber with elevated privileges. The exposure requires an attacker who already has a shell account on the machine, so multi-user or shared hosts carry the most risk. Single-operator servers where ast_loggrabber is never run by a privileged user can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":3463,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-57203':15A,18A '/tmp':12A,42B,107C '20.20.1':85C,153C '20.7':92C,160C '21.12.3':86C,154C '22.10.1':87C,155C '22.8':94C,162C '23.4.1':88C,156C 'administr':67B,137C 'alreadi':48B,111C 'ast':2A,27B,96C,139C 'asterisk':1A,19B,31B,71C,84C,91C,120C,152C,159C 'attack':110C 'author':112C 'branch':77C 'cert11':93C,161C 'cert3':95C,163C 'certifi':90C,158C 'code':134C 'cve':13A,16A 'directori':43B,108C 'elev':63B,130C,145C 'exchang':78C 'execut':98C,133C 'fix':150C 'gain':62B,129C 'host':24B 'issu':148C 'linux':20B 'local':45B 'loggrabb':3A,28B,97C,140C 'malici':58B,125C 'may':122C 'open':74C,114C 'place':123C 'plant':7A,56B 'prior':82C 'privat':76C 'privileg':64B,131C,146C 'python':34B,100C 'run':4A,32B,68B,138C 'runtim':21B 'script':6A,35B,59B,101C,126C 'self':23B 'self-host':22B 'server':54B,121C 'session':117C 'shell':51B,116C 'sourc':75C 'taken':36B 'telephoni':25B,80C 'tool':29B,70B 'toolkit':81C 'user':46B,143C 'world':10A,40B,105C 'world-writ':9A,39B,104C 'writabl':11A,41B,106C","nicknames":[],"mitigations":[],"who_affected":"Servers running affected Asterisk releases where someone runs ast_loggrabber with elevated privileges. The exposure requires an attacker who already has a shell account on the machine, so multi-user or shared hosts carry the most risk. Single-operator servers where ast_loggrabber is never run by a privileged user can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57203","severity":null,"published_at":"2026-10-27T22:17:27+00:00","modified_at":"2026-10-27T22:17:27+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","fetched_at":"2026-10-27T22:29:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}