Quick answers
- Is CVE-2026-58000 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58000 being exploited in the wild.
- How severe is CVE-2026-58000?
- High severity, with a CVSS score of 8.8, published 29 June 2026.
- Which products and versions are affected?
- OpenWrt luci-proto-openvpn through 0.11.1.
- Is there a fix for CVE-2026-58000?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-58000 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-58000?
- Check whether you run OpenWrt LuCI OpenVPN Protocol Support. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability exists in the 'generateKey' ubus method within 'luci.openvpn.uc'. The 'cl_meta' parameter is interpolated directly into a shell command string passed to the 'popen()' function without proper escaping or quoting via 'shellquote()'. While the LuCI web interface base64 encodes this field, the underlying ubus method accepts raw input. An authenticated attacker with 'luci-proto-openvpn' ACL permissions can use shell metacharacters (e.g., $(command)) to achieve arbitrary code execution as the root user. The issue is fixed in commit e4ff45e by applying proper shell quoting to the affected parameter.
Affected products
- OpenWrt luci-proto-openvpn through 0.11.1
Timeline
- 2026-06-27: advisory: GitHub Security Advisory GHSA-pm9w-522m-8rrh published
- 2026-06-29: disclosed: CVE-2026-58000 published to NVD