Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

tinc lets attackers run code remotely

published 4 days ago

Summary

The tinc networking tool can be tricked into executing malicious commands. This could let an attacker take control of the system that runs tinc. Update to the latest version or apply the provided security patch as soon as possible.

What to do

Update cleanstart tinc to version 1.0.35-r0.

Affected software

Ecosystem	Vendor	Product	Affected versions
CleanStart	cleanstart	tinc	< 1.0.35-r0 Fix: upgrade to 1.0.35-r0

Original advisory text

tinc 1

Security vulnerability affects the tinc package. tinc 1.

References

https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advis... Vendor Advisory
https://osv.dev/vulnerability/CVE-2018-16738 URL
https://nvd.nist.gov/vuln/detail/CVE-2018-16738 URL

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

3.7 Low

Timeline

Published31 Oct 2026

Updated31 Oct 2026

First seen31 Oct 2026

Sources

CLEANSTART-2024-SY22020 · OSV

Track software like this

Free during beta