Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-126781: Webmin lets logged‑in users gain root access
CVE-2026-126781 · published 2 days ago
Summary
If you use Webmin version 2.670 or earlier, a logged‑in user can add special characters to a certificate field that tricks the system into creating a new admin account with a known password. After the Webmin service restarts, that attacker can log in as the top‑level administrator. Upgrade Webmin to the latest release and limit who can log into the Webmin interface.
Original advisory text
Webmin through 2.670 Users File Injection via acl/cert_issue.cgi
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
References
- https://github.com/webmin/webmin/blob/2.670/acl/cert_issue.cgi#L22-L52 Third Party Advisory
- https://github.com/webmin/webmin/commit/0c449e341746d8c445c8c7db223eac1f41755943 Patch
- https://github.com/webmin/webmin/commit/8fb194e5fbc30a6664545d48940d03759ace9bf2 Patch
- https://www.vulncheck.com/advisories/webmin-through-2.670-users-file-injection-v... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-1267... Vendor Advisory
- https://github.com/webmin/webmin Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-126781 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
Timeline
Published11 Nov 2026
Updated13 Nov 2026
First seen11 Nov 2026
Track software like this
Free during beta