Is CVE-2026-58652 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58652 being exploited in the wild.

How severe is CVE-2026-58652?

High severity, with a CVSS score of 7.5, published 2 July 2026.

Which products and versions are affected?

OpenWrt Luci-App-Travelmate 2.4.5-r3, 2.4.6-1; OpenWrt Travelmate 2.4.5-r3, 2.4.6-1.

Is there a fix for CVE-2026-58652?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-58652 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58652?

Check whether you run OpenWrt Luci-App-Travelmate or OpenWrt Travelmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58652: OpenWrt luci-app-travelmate privilege escalation to root via UCI script parameter

CVE-2026-58652 · Severity: high · CVSS 7.5 · Published 2026-07-02

The travelmate application, used on OpenWrt routers to automate connections to hotel and public Wi-Fi networks, contains a security flaw that allows for unauthorized command execution. An attacker who has been granted limited administrative access to manage travelmate settings can bypass interface restrictions to run arbitrary commands as the system's root user. This could lead to a complete takeover of the router, allowing an attacker to intercept network traffic or disable security features.

Vendors: OpenWrt.

Quick answers

Is CVE-2026-58652 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58652 being exploited in the wild.
How severe is CVE-2026-58652?: High severity, with a CVSS score of 7.5, published 2 July 2026.
Which products and versions are affected?: OpenWrt Luci-App-Travelmate 2.4.5-r3, 2.4.6-1; OpenWrt Travelmate 2.4.5-r3, 2.4.6-1.
Is there a fix for CVE-2026-58652?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-58652 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58652?: Check whether you run OpenWrt Luci-App-Travelmate or OpenWrt Travelmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in luci-app-travelmate and the underlying travelmate package due to insecure handling of UCI configuration values. While the LuCI web interface attempts to restrict the 'script' parameter to specific login files, this is only a frontend validation. The backend travelmate service, running as root, reads the raw 'script' and 'script_args' values from the UCI configuration and executes them via travelmate-functions.sh when a captive portal is detected. An attacker with delegated write permissions to the travelmate configuration can set the script to an interpreter like /bin/sh and provide malicious arguments, resulting in arbitrary command execution as root. As of the advisory date, no patched version is known, though the flaw is confirmed in versions 2.4.5-r3 and 2.4.6-1.

Affected products

OpenWrt luci-app-travelmate 2.4.5-r3, 2.4.6-1
OpenWrt travelmate 2.4.5-r3, 2.4.6-1

Timeline

2026-06-17: advisory: Initial GHSA advisory published by researcher
2026-07-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.