Is CVE-2026-56021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56021 being exploited in the wild.

How severe is CVE-2026-56021?

Medium severity, with a CVSS score of 5.3, published 18 June 2026.

Is there a fix for CVE-2026-56021?

A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56021 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-56021?

Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56021: Webmin information disclosure via regex bypass in module directories

CVE-2026-56021 · Severity: medium · CVSS 5.3 · Published 2026-06-18

Webmin, a web-based interface for system administration, contains a security flaw that allows unauthorized individuals to read configuration files. An attacker can access sensitive information stored in files ending in .conf within the application's module directories without needing a username or password. This could lead to the exposure of system settings or other internal data, potentially aiding further attacks.

Technologies: Webmin. Vendors: Webmin.

Quick answers

Is CVE-2026-56021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56021 being exploited in the wild.
How severe is CVE-2026-56021?: Medium severity, with a CVSS score of 5.3, published 18 June 2026.
Which products and versions are affected?: Webmin prior to 2.641.
Is there a fix for CVE-2026-56021?: A patch was published on 2026-05-11: Webmin version 2.641 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56021 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56021?: Check whether you run Webmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Webmin due to an incorrect regular expression (CWE-185) and a lack of anchors (CWE-777) in the pattern used to restrict file access. Unauthenticated attackers can exploit this flaw to bypass security checks and read any file ending in the .conf extension located within module directories. The attack is carried out over the network without requiring user interaction or prior authentication. This issue was addressed in Webmin version 2.641.

Affected products

Webmin Webmin prior to 2.641

Timeline

2026-05-11: patched: Webmin version 2.641 released
2026-06-18: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.