Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-72603: wg-easy lets certain users execute commands as root
CVE-2026-72603 · published 2 months ago
Summary
The wg-easy tool (version 15.3.0) lets users who can create new VPN clients add a name that is written straight into the system’s WireGuard configuration file. Because newline characters aren’t filtered, a malicious name can insert extra commands that run with full system privileges. Fix the issue by applying the vendor’s update or by limiting who can create clients until the patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wg-easy | wg-easy | <= 15.3.0 |
Original advisory text
wg-easy wg-easy - OS Command Injection
An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the WireGuard configuration file without neutralizing newline characters, allowing injection of arbitrary directives that are executed by wg-quick with root privileges. An attacker with clients.create permission achieves root code execution on the host.
References
- https://github.com/wg-easy/wg-easy Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72603... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-72603 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published11 Aug 2026
Updated25 Oct 2026
First seen11 Aug 2026
Track software like this
Free during beta