What’s Vulnerable › Vulnerabilities
CVE-2026-23741: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-06 · updated 2026-06-17
- Weakness: CWE-427
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected products
- asterisk: before 20.18.2; from 21.0.0 before 21.12.1; from 22.0.0 before 22.8.2; from 23.0.0 before 23.2.2 — fixed in 20.18.2, 21.12.1, 22.8.2, 23.2.2
- Sangoma Certified Asterisk: through 18.9; 20.7-cert1, 20.7-cert1-rc1, 20.7-cert1-rc2, 20.7-cert2, 20.7-cert3, 20.7-cert4 (+4)
How to fix
Upgrade to a fixed version: asterisk 20.18.2, 21.12.1, 22.8.2, 23.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23741 or the next vulnerability affects your stack