# CVE-2026-61876: OpenWrt LuCI stored XSS in DHCPv6 lease status tables

Source: https://junglewise.ai/threats/cve-2026-61876-openwrt-luci-stored-xss-in-dhcpv6-lease-status-tables  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-12. Updated: 2026-07-12  
License: CC BY 4.0 with a link back

CVE-2026-61876 · Severity: high · CVSS 8.8 · Published 2026-07-12

LuCI, the web interface for OpenWrt routers, contains a security flaw in how it displays network device names. An attacker on the local network can send a specially crafted device name that, when viewed by a router administrator, executes malicious code in the admin's browser. This could allow the attacker to change router settings, steal session information, or gain unauthorized access to the management interface.

Technologies: [OpenWrt LuCI](https://junglewise.ai/threats/technologies/luci). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-61876 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61876 being exploited in the wild.

**How severe is CVE-2026-61876?** High severity, with a CVSS score of 8.8, published 12 July 2026.

**Which products and versions are affected?** OpenWrt LuCI master.

**Is there a fix for CVE-2026-61876?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-61876 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2026-61876?** Check whether you run OpenWrt LuCI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in LuCI due to improper neutralization of DHCPv6 Client FQDN (hostname) data. An unauthenticated adjacent-network attacker can send a DHCPv6 Solicit/Request containing HTML markup in the FQDN option. The odhcpd daemon stores this value, which is subsequently retrieved by luci-rpc.getDHCPLeases and rendered via innerHTML in the LuCI status and DHCP configuration tables (specifically in luci-mod-status and luci-mod-network). When an authenticated administrator views the 'Status > Overview' or 'Network > DHCP and DNS' pages, the injected script executes in the context of their session. The vulnerability is rooted in the use of L.dom.append() with raw strings in cbi.js and ui.js.

## Affected products

- OpenWrt LuCI master

## Timeline

- 2026-06-27: advisory: GitHub Security Advisory published by OpenWrt developers
- 2026-07-12: disclosed: CVE published to NVD dataset

## References

- [https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh](https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh)
- [https://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting](https://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting)

## Related threats

- [OpenWrt LuCI heap buffer overflow in ASN.1 certificate signing](https://junglewise.ai/threats/cve-2026-62381-openwrt-luci-heap-buffer-overflow-in-asn-1-certificate-signing)
- [OpenWrt LuCI mount configuration ACL permission escalation](https://junglewise.ai/threats/cve-2026-72840-openwrt-luci-mount-configuration-acl-permission-escalation)
- [OpenWrt luci-app-banip improper input validation in log parser](https://junglewise.ai/threats/cve-2026-62184-openwrt-luci-app-banip-improper-input-validation-in-log-parser)