# OpenWrt vulnerabilities Source: https://junglewise.ai/threats/vendors/openwrt Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/openwrt.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 43 vulnerabilities in OpenWrt: 0 in the last 7 days and 10 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55614, was published on 30 October 2026. 7 vulnerabilities in the last four weeks, up 250% on the four before (2). 1 critical against 0. 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 6 - Last 90 days: 10 - All time: 43 (6 critical, 0 exploited in the wild) ## About OpenWrt An open-source project providing a Linux-based operating system for embedded devices and routers. ## Latest OpenWrt vulnerabilities - [CVE-2026-55614: uhttpd HTTP request smuggling in Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2026-55614-uhttpd-is-a-small-http-server-in-unpatched-repository-snapshots) (info, published 30 Oct 2026) - [CVE-2026-55613: uhttpd HTTP request smuggling in ubus POST handler](https://junglewise.ai/threats/cve-2026-55613-uhttpd-is-a-small-http-server-in-unpatched-repository-snapshots) (info, published 30 Oct 2026) - [CVE-2026-55606: odhcpd out-of-bounds read in DHCPv6 self-loop detection](https://junglewise.ai/threats/cve-2026-55606-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (medium, CVSS 6.5, published 23 Oct 2026) - [CVE-2026-53921: odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2026-53920: odhcpd DHCPv6 IA parser stack buffer overread](https://junglewise.ai/threats/cve-2026-53920-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (info, published 23 Oct 2026) - [CVE-2026-53918: odhcpd heap-use-after-free in DHCPv6 IA handler](https://junglewise.ai/threats/cve-2026-53918-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (info, published 23 Oct 2026) - [CVE-2026-53922: odhcpd integer underflow in DHCPv6 IA handling](https://junglewise.ai/threats/cve-2026-53922-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-55897: OpenWrt luci-app-advanced-reboot privilege escalation via rpcd ACL](https://junglewise.ai/threats/cve-2026-55897-luci-app-advanced-reboot-is-a-luci-web-interface-application-for) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-55159: luci-app-adblock-fast command injection in RPC cron entry](https://junglewise.ai/threats/cve-2026-55159-luci-app-adblock-fast-a-webui-for-fast-lightweight-dns-based-ad) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-62381: OpenWrt LuCI heap buffer overflow in ASN.1 certificate signing](https://junglewise.ai/threats/cve-2026-62381-openwrt-luci-heap-buffer-overflow-in-asn-1-certificate-signing) (medium, CVSS 6.6, published 22 Aug 2026) - [CVE-2026-72842: OpenWrt luci-app-lxc ACL bypass in container management](https://junglewise.ai/threats/cve-2026-72842-openwrt-luci-app-lxc-acl-bypass-in-container-management) (critical, CVSS 9.9, published 13 Aug 2026) - [CVE-2026-72841: OpenWrt luci-app-openvpn path traversal and arbitrary file write](https://junglewise.ai/threats/cve-2026-72841-openwrt-luci-app-openvpn-path-traversal-and-arbitrary-file-write) (critical, CVSS 9.9, published 13 Aug 2026) - [CVE-2026-72840: OpenWrt LuCI mount configuration ACL permission escalation](https://junglewise.ai/threats/cve-2026-72840-openwrt-luci-mount-configuration-acl-permission-escalation) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-68583: OpenWrt LuCI AdBlock Fast stored XSS in blocklist name](https://junglewise.ai/threats/cve-2026-68583-openwrt-luci-adblock-fast-stored-xss-in-blocklist-name) (medium, CVSS 5.4, published 2 Aug 2026) - [CVE-2026-62947: OpenWrt cgi-io path traversal in cgi-download and cgi-exec](https://junglewise.ai/threats/cve-2026-62947-openwrt-cgi-io-path-traversal-in-cgi-download-and-cgi-exec) (medium, CVSS 4.9, published 15 Jul 2026) - [CVE-2026-62948: OpenWrt odhcpd and LuCI stored XSS via DHCPv6 hostname injection](https://junglewise.ai/threats/cve-2026-62948-openwrt-odhcpd-and-luci-stored-xss-via-dhcpv6-hostname-injection) (critical, CVSS 9.6, published 15 Jul 2026) - [CVE-2026-62184: OpenWrt luci-app-banip improper input validation in log parser](https://junglewise.ai/threats/cve-2026-62184-openwrt-luci-app-banip-improper-input-validation-in-log-parser) (high, CVSS 7.5, published 13 Jul 2026) - [CVE-2026-61876: OpenWrt LuCI stored XSS in DHCPv6 lease status tables](https://junglewise.ai/threats/cve-2026-61876-openwrt-luci-stored-xss-in-dhcpv6-lease-status-tables) (high, CVSS 8.8, published 12 Jul 2026) - [CVE-2026-61875: OpenWrt luci-app-upnp stored XSS via UPnP port mapping description](https://junglewise.ai/threats/cve-2026-61875-openwrt-luci-app-upnp-stored-xss-via-upnp-port-mapping) (high, CVSS 8.8, published 12 Jul 2026) - [CVE-2026-59260: OpenWrt luci-app-samba4 privilege escalation in smbd ACL](https://junglewise.ai/threats/cve-2026-59260-openwrt-luci-app-samba4-privilege-escalation-in-smbd-acl) (high, CVSS 8.8, published 12 Jul 2026) - [CVE-2026-55490: OpenWrt Emergency Access Daemon integer underflow in handle_send_a](https://junglewise.ai/threats/cve-2026-55490-openwrt-emergency-access-daemon-integer-underflow-in-handle-send) (medium, CVSS 6.5, published 7 Jul 2026) - [CVE-2026-58652: OpenWrt luci-app-travelmate privilege escalation to root via UCI script parameter](https://junglewise.ai/threats/cve-2026-58652-openwrt-luci-app-travelmate-privilege-escalation-to-root-via-uci) (high, CVSS 7.5, published 2 Jul 2026) - [CVE-2026-58000: OpenWrt luci-proto-openvpn command injection in generateKey](https://junglewise.ai/threats/cve-2026-58000-openwrt-luci-proto-openvpn-command-injection-in-generatekey) (high, CVSS 8.8, published 29 Jun 2026) - [CVE-2026-57999: OpenWrt luci-app-tailscale-community command injection in do_login RPC](https://junglewise.ai/threats/cve-2026-57999-openwrt-luci-app-tailscale-community-command-injection-in-do) (high, CVSS 8.8, published 29 Jun 2026) - [CVE-2026-30872: OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30872-openwrt-project-is-a-linux-operating-system-targeting-embedded) (critical, CVSS 9.8, published 19 Mar 2026) ## Most severe OpenWrt vulnerabilities - [CVE-2026-72842: OpenWrt luci-app-lxc ACL bypass in container management](https://junglewise.ai/threats/cve-2026-72842-openwrt-luci-app-lxc-acl-bypass-in-container-management) (critical, CVSS 9.9, published 13 Aug 2026) - [CVE-2026-72841: OpenWrt luci-app-openvpn path traversal and arbitrary file write](https://junglewise.ai/threats/cve-2026-72841-openwrt-luci-app-openvpn-path-traversal-and-arbitrary-file-write) (critical, CVSS 9.9, published 13 Aug 2026) - [CVE-2026-30872: OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30872-openwrt-project-is-a-linux-operating-system-targeting-embedded) (critical, CVSS 9.8, published 19 Mar 2026) - [CVE-2026-30871: OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30871-openwrt-project-is-a-linux-operating-system-targeting-embedded) (critical, CVSS 9.8, published 19 Mar 2026) - [CVE-2026-53921: odhcpd DHCPv6 stack buffer overflow in IA response handler](https://junglewise.ai/threats/cve-2026-53921-odhcpd-is-the-dhcpv6-dhcpv4-and-router-advertisement-server-used) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2026-62948: OpenWrt odhcpd and LuCI stored XSS via DHCPv6 hostname injection](https://junglewise.ai/threats/cve-2026-62948-openwrt-odhcpd-and-luci-stored-xss-via-dhcpv6-hostname-injection) (critical, CVSS 9.6, published 15 Jul 2026) - [CVE-2026-55159: luci-app-adblock-fast command injection in RPC cron entry](https://junglewise.ai/threats/cve-2026-55159-luci-app-adblock-fast-a-webui-for-fast-lightweight-dns-based-ad) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-55897: OpenWrt luci-app-advanced-reboot privilege escalation via rpcd ACL](https://junglewise.ai/threats/cve-2026-55897-luci-app-advanced-reboot-is-a-luci-web-interface-application-for) (high, CVSS 8.8, published 21 Sep 2026) - [CVE-2026-72840: OpenWrt LuCI mount configuration ACL permission escalation](https://junglewise.ai/threats/cve-2026-72840-openwrt-luci-mount-configuration-acl-permission-escalation) (high, CVSS 8.8, published 13 Aug 2026) - [CVE-2026-61876: OpenWrt LuCI stored XSS in DHCPv6 lease status tables](https://junglewise.ai/threats/cve-2026-61876-openwrt-luci-stored-xss-in-dhcpv6-lease-status-tables) (high, CVSS 8.8, published 12 Jul 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 250% on the four before (2). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 4 | 1 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## OpenWrt technologies - [OpenWrt](https://junglewise.ai/threats/technologies/openwrt): 22 vulnerabilities - [OpenWrt Odhcpd](https://junglewise.ai/threats/technologies/odhcpd): 5 vulnerabilities - [OpenWrt LuCI](https://junglewise.ai/threats/technologies/luci): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenWrt vulnerabilities", https://junglewise.ai/threats/vendors/openwrt, 12 November 2026.