Is CVE-2026-56020 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56020 being exploited in the wild.

How severe is CVE-2026-56020?

High severity, with a CVSS score of 8.1, published 18 June 2026.

Which products and versions are affected?

Webmin versions prior to 2.641.

Is there a fix for CVE-2026-56020?

A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56020 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-56020?

Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56020: Webmin authentication bypass via SSL certificate spoofing in miniserv.pl

CVE-2026-56020 · Severity: high · CVSS 8.1 · Published 2026-06-18

Webmin, a popular web-based interface for system administration, contains a vulnerability that allows attackers to bypass security checks and log in as any user. By sending a specially crafted web request, an attacker can trick the system into believing they have a valid security certificate. This could lead to a complete takeover of the server and unauthorized access to sensitive administrative functions.

Technologies: Webmin. Vendors: Webmin.

Quick answers

Is CVE-2026-56020 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56020 being exploited in the wild.
How severe is CVE-2026-56020?: High severity, with a CVSS score of 8.1, published 18 June 2026.
Which products and versions are affected?: Webmin versions prior to 2.641.
Is there a fix for CVE-2026-56020?: A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56020 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56020?: Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in Webmin's miniserv.pl component due to improper validation of proxy-provided HTTP headers. When Webmin is configured to trust remote IP addresses from a proxy, it may incorrectly trust SSL client certificate information provided in forged HTTP headers from clients connecting directly to the server. An unauthenticated remote attacker can exploit this by spoofing certificate Distinguished Names (DNs) to impersonate any user configured for certificate-based authentication. This vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing). The issue is resolved in Webmin version 2.641.

Affected products

Webmin Webmin versions prior to 2.641

Timeline

2026-05-11: patched: Webmin version 2.641 released
2026-06-18: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.