Is CVE-2026-38979 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38979 being exploited in the wild.

How severe is CVE-2026-38979?

Informational severity, with a CVSS score of 0, published 6 July 2026.

Is there a fix for CVE-2026-38979?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-38979 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-38979?

Check whether you run Ajenti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38979: Ajenti clickjacking weakness in administrative UI

CVE-2026-38979 · Severity: info · CVSS 0 · Published 2026-07-06

Ajenti, a server administration panel, contains a security weakness that could allow an attacker to trick users into performing unintended actions. By embedding the Ajenti interface into a malicious website, an attacker could overlap invisible buttons or forms over the legitimate UI. This could lead to unauthorized configuration changes or administrative actions if a logged-in administrator is deceived into clicking on the page.

Technologies: Ajenti. Vendors: Ajenti.

Quick answers

Is CVE-2026-38979 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38979 being exploited in the wild.
How severe is CVE-2026-38979?: Informational severity, with a CVSS score of 0, published 6 July 2026.
Which products and versions are affected?: Ajenti through 2.2.13.
Is there a fix for CVE-2026-38979?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-38979 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-38979?: Check whether you run Ajenti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Ajenti through v2.2.13 is vulnerable to clickjacking due to the absence of defensive HTTP headers in its core response path. Specifically, in `ajenti-core/aj/http.py`, the application initializes an empty header list and finalizes responses via WSGI `start_response()` without enforcing `X-Frame-Options` or `Content-Security-Policy: frame-ancestors`. This allows the administrative UI to be rendered within an <iframe> on a remote, attacker-controlled domain. An attacker can exploit this to perform UI redressing attacks against authenticated users. A patch has been identified in the project's repository that explicitly adds these headers if they are not already present.

Affected products

Ajenti Ajenti through 2.2.13

Timeline

2026-07-06: advisory: CVE-2026-38979 published by NVD
2026-07-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.