Quick answers
- Is CVE-2026-38820 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-38820 being exploited in the wild.
- How severe is CVE-2026-38820?
- High severity, with a CVSS score of 8.3, published 28 August 2026.
- Which products and versions are affected?
- openNDS before 11.0.0.
- Is there a fix for CVE-2026-38820?
- A patch was published on 2026: Fix applied in commit 8c03750; version 11.0.0 or later contains the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-38820 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-38820?
- Check whether you run openNDS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
openNDS before version 11.0.0 contains an OS command injection vulnerability (CWE-78) in the /opennds_preauth/ endpoint's fas query parameter, caused by insufficient input validation in the libopennds.sh shell script library. The vulnerability allows an unauthenticated attacker to inject arbitrary shell commands through the fas parameter, which are then executed with the privileges of the openNDS process. The attack requires network access to the openNDS service but no authentication or user interaction. A fix was implemented in commit 8c03750 to sanitize and block malicious command injection patterns.
Affected products
- openNDS openNDS before 11.0.0
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix applied in commit 8c03750; version 11.0.0 or later contains the patch