High 8.8Published May 26, 2026

CVE-2026-46368luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

Updated under an hour ago (Oct 26, 2026, 4:40 PM ET)

Does this affect you?

It affects mossdef-org luci-app-https-dns-proxy. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for mossdef-org luci-app-https-dns-proxy

Exploited in the last 30 days

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-77
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

mossdef-org luci-app-https-dns-proxy mossdef_org:luci_app_https_dns_proxy (from the name)	through 2025.12.29-5	CNA record

References

References

https://www.exploit-db.com/exploits/52521	exploit
https://github.com/stangri/luci-app-https-dns-proxy	product
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-authenticated-command-injection-via-setinitaction	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.