Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

BusyBox httpd can reveal valid usernames

CVE-2026-88834 · published 4 days ago
Summary

BusyBox’s built‑in web server can leak whether a username exists when it is set up to use system passwords and compiled with uncommon options. This issue only affects certain custom builds of BusyBox on Debian and Red Hat hardened images; default installations that use shadow passwords are not impacted. Use the standard build settings, avoid enabling system‑password authentication, or apply the vendor’s update to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– red hat red hat hardened images All versions
Debian:12 debian busybox All versions
Ubuntu:Pro:14.04:LTS canonical busybox All versions
Original advisory text
DEBIAN-CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-203Observable Discrepancy
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-88834 · NVD
CVE-2026-88834 · MITRE
DEBIAN-CVE-2026-88834 · OSV
UBUNTU-CVE-2026-88834 · OSV
Track software like this
Free during beta