Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-79920: Ajenti admin panel lets low‑privilege users gain full system control
CVE-2026-79920 · published today
Summary
In versions of Ajenti before 2.2.16, any signed‑in user could ask the system to install, remove, or upgrade plugins. Because the request runs as the system’s administrator (root), a user without proper rights could cause malicious code to run with full privileges, compromising the whole server. Upgrade Ajenti to version 2.2.16 or later to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ajenti | ajenti | < 2.2.16 |
Original advisory text
Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
Severity
9.9
Critical
CVSS 3.1: 9.9 (MITRE)
Type
CWE-862Missing Authorization
Timeline
Published21 Sep 2026
Updated21 Sep 2026
First seen21 Sep 2026
Track software like this
Free during beta