CVE-2026-72842: OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-09-30
Weakness: CWE-73

Description

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.

Affected products

openwrt luci: through 24.10.8; from 25.12.0 through 25.12.5

References

https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2
https://www.vulncheck.com/advisories/openwrt-luci-app-lxc-acl-inconsistency-authentication-bypass

Get alerted when CVE-2026-72842 or the next vulnerability affects your stack