# CVE-2026-82413: ntopng OS command injection in vulnerability-scan REST endpoint

Source: https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-82413 · Severity: high · CVSS 8.8 · Published 2026-11-05

ntopng is a web-based network traffic monitoring application that includes a vulnerability scan feature. The vulnerability allows any authenticated user, including non-administrator accounts, to inject arbitrary operating-system commands that execute as the ntopng service account through the scan_ports parameter. In deployments with login disabled, the vulnerability is exploitable without any authentication.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2026-82413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82413 being exploited in the wild.

**How severe is CVE-2026-82413?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** Ntopng prior to 6.7.260717.

**Is there a fix for CVE-2026-82413?** Yes: fixed in 6.7.260717. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82413 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82413?** Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.7.260717

## Technical details

The REST endpoints /lua/rest/v2/add/host/to_scan.lua and /lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter from authenticated sessions without administrator role checks. The validateSingleWord function filters only spaces and single quotes but permits shell metacharacters (;, |, &, $, `, (, ), {, }). The scan_ports value is concatenated directly into an nmap command line executed via popen(), allowing command injection with payload like scan_ports=1;id|tee${IFS}/tmp/x. The attack requires nmap to be installed, which is the default in the official Docker image.

## Affected products

- ntop ntopng prior to 6.7.260717

## Timeline

- 2026-07-16: advisory
- 2026-11-05: disclosed

## References

- [https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5](https://github.com/ntop/ntopng/commit/fda269014c6a8a445c2c893cf9d2fad0128364a5)
- [https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p](https://github.com/ntop/ntopng/security/advisories/GHSA-9xj6-f266-r46p)

## Related threats

- [ntopng stack buffer overflow in nDPI custom category detection](https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng privilege escalation in pools bulk-delete endpoint](https://junglewise.ai/threats/cve-2026-86091-ntopng-privilege-escalation-in-pools-bulk-delete-endpoint)