CVE-2026-57200: Asterisk authorization bypass in ARI REST-over-WebSocket

CVE-2026-57200 · Severity: high · CVSS 7.5 · Published 2026-10-27

Asterisk is an open-source telecommunications platform used to build telephone systems and voice applications. An authenticated attacker with read-only API credentials can bypass authorization checks through the REST-over-WebSocket interface to perform write operations, potentially loading malicious modules and executing arbitrary code. The vulnerability requires an attacker to already possess valid read-only credentials and requires the HTTP web server to be enabled.

Technologies: Asterisk. Vendors: Asterisk.

Quick answers

Is CVE-2026-57200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57200 being exploited in the wild.
How severe is CVE-2026-57200?
High severity, with a CVSS score of 7.5, published 27 October 2026.
Which products and versions are affected?
Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Certified Asterisk before 22.8-cert3.
Is there a fix for CVE-2026-57200?
Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 22.8-cert3. Until then: Disable the HTTP web server if not required, or restrict HTTP access to the localhost/loopback interface (127.0.0.1) where it is bound by default. Limit network access to the Asterisk HTTP server and ensure ARI read-only credentials are not distributed to untrusted users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57200 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-57200?
Check whether you run Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 22.8-cert3

Disable the HTTP web server if not required, or restrict HTTP access to the localhost/loopback interface (127.0.0.1) where it is bound by default. Limit network access to the Asterisk HTTP server and ensure ARI read-only credentials are not distributed to untrusted users.

Technical details

The vulnerability is an authorization bypass in the Asterisk REST Interface (ARI) REST-over-WebSocket handler where query parameters from the initial GET upgrade request were not properly forwarded to subsequent REST requests over the WebSocket connection. An authenticated attacker with read-only ARI credentials can execute non-GET methods (PUT, DELETE, POST) through the WebSocket, bypassing the intended read-only permission model. This allows arbitrary module path loading and conditional remote code execution on the Asterisk server.

Affected products

  • Asterisk Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Certified Asterisk before 22.8-cert3

Timeline

  • 2026-10-27: disclosed
  • 2026-06-25: patched: Patches committed to resolve GHSA-wcvv-g26m-wx5c

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.