Live › vulnerability › CVE-2026-66088
Go to dashboardIn openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list. A user who can create or edit scripts can run arbitrary commands with the privileges of the openEQUELLA service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Teams running openEQUELLA before 2026.1 where users other than trusted administrators can create or edit scripts. The exposure is the scripting engine's access to system.execute(), so instances where only trusted staff write scripts carry less immediate risk but should still be upgraded.
No product ranges from the sources yet.
2026.1; anything older is in range.2026.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
This page as .md · .json · in your agent: get_signal("CVE-2026-66088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.