# CVE-2026-38820: openNDS unauthenticated OS command injection in fas parameter

Source: https://junglewise.ai/threats/cve-2026-38820-opennds-unauthenticated-os-command-injection-in-fas-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-38820 · Severity: high · CVSS 8.3 · Published 2026-08-28

openNDS is a captive portal system that manages network access for guest users. A vulnerability in its authentication service allows an unauthenticated attacker to execute arbitrary operating system commands on the server by injecting shell commands through a web request parameter, potentially compromising the entire system.

Technologies: [openNDS](https://junglewise.ai/threats/technologies/opennds). Vendors: [openNDS](https://junglewise.ai/threats/vendors/opennds).

## Quick answers

**Is CVE-2026-38820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38820 being exploited in the wild.

**How severe is CVE-2026-38820?** High severity, with a CVSS score of 8.3, published 28 August 2026.

**Which products and versions are affected?** openNDS before 11.0.0.

**Is there a fix for CVE-2026-38820?** A patch was published on 2026: Fix applied in commit 8c03750; version 11.0.0 or later contains the patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38820 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-38820?** Check whether you run openNDS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

openNDS before version 11.0.0 contains an OS command injection vulnerability (CWE-78) in the /opennds_preauth/ endpoint's fas query parameter, caused by insufficient input validation in the libopennds.sh shell script library. The vulnerability allows an unauthenticated attacker to inject arbitrary shell commands through the fas parameter, which are then executed with the privileges of the openNDS process. The attack requires network access to the openNDS service but no authentication or user interaction. A fix was implemented in commit 8c03750 to sanitize and block malicious command injection patterns.

## Affected products

- openNDS openNDS before 11.0.0

## Timeline

- 2026-08-28: disclosed
- 2026: patched: Fix applied in commit 8c03750; version 11.0.0 or later contains the patch

## References

- [https://github.com/openNDS/openNDS/commit/8c03750d9a17d601fa7bd03ae7cde20c7c8d1252](https://github.com/openNDS/openNDS/commit/8c03750d9a17d601fa7bd03ae7cde20c7c8d1252)

## Related threats

- [openNDS command injection in client_params.sh](https://junglewise.ai/threats/cve-2026-38822-opennds-command-injection-in-client-params-sh)
- [openNDS heap-based buffer overflow in http_microhttpd](https://junglewise.ai/threats/cve-2026-38821-opennds-heap-based-buffer-overflow-in-http-microhttpd)
- [openNDS memory leak denial of service](https://junglewise.ai/threats/cve-2026-38819-opennds-memory-leak-denial-of-service)