Quick answers
- Is CVE-2026-126781 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-126781 being exploited in the wild.
- How severe is CVE-2026-126781?
- High severity, with a CVSS score of 7.5, published 11 November 2026.
- Which products and versions are affected?
- Webmin through 2.670.
- Is there a fix for CVE-2026-126781?
- Yes: fixed in Webmin 2.671 and later (based on commit 0c449e3). Until then: Restrict access to the certificate issuance functionality in acl/cert_issue.cgi to trusted administrators only, or disable certificate issuance until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-126781 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-126781?
- Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Webmin 2.671 and later (based on commit 0c449e3)
Restrict access to the certificate issuance functionality in acl/cert_issue.cgi to trusted administrators only, or disable certificate issuance until upgrading.
Technical details
The acl/cert_issue.cgi script in Webmin through 2.670 fails to validate certificate Distinguished Name (DN) fields for newline characters before writing them to a configuration file. An authenticated attacker can inject newlines and backslash characters in fields such as commonName or organizationName to add malicious lines to the users file. Upon miniserv restart, these injected lines are parsed, allowing the attacker to create a new root account and escalate privileges.
Affected products
- Webmin Webmin through 2.670
Timeline
- 2026-11-11: disclosed