CVE-2026-101860: RaspAP Privilege Escalation Vulnerability

CVE-2026-101860 Overview

CVE-2026-101860 is an improper privilege management vulnerability [CWE-266] in RaspAP raspap-webgui versions up to 3.5.5. The flaw resides in the PluginInstaller::addSudoers function within src/RaspAP/Plugins/PluginInstaller.php, which handles sudo configuration for plugin installations. An attacker with low-level privileges can manipulate the affected function remotely to escalate privileges on the underlying host. Public exploit code has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote authenticated attackers can abuse the plugin sudoers configuration path to gain elevated privileges on the RaspAP host, exposing the wireless access point to full compromise.

Affected Products

RaspAP raspap-webgui versions up to and including 3.5.5
Deployments using the PluginInstaller component for plugin management
Systems relying on the sudo configuration written by PluginInstaller::addSudoers

Discovery Timeline

2026-09-29 - CVE-2026-101860 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-101860

Vulnerability Analysis

The vulnerability affects the PluginInstaller::addSudoers function inside src/RaspAP/Plugins/PluginInstaller.php. RaspAP uses this routine to register sudo rules that allow the web interface to execute privileged actions during plugin installation. Improper privilege management in this code path lets an authenticated remote user influence the sudoers configuration written to disk. The result is a path to privilege escalation on the host running the RaspAP web GUI.

Because RaspAP typically runs on Raspberry Pi devices operating as wireless access points, successful exploitation grants attackers control over network routing, DNS, DHCP, and captive portal functionality. The attack is network-reachable through the RaspAP web interface and requires only low-privileged access.

Root Cause

The root cause is improper privilege management [CWE-266] within the plugin installer. addSudoers writes sudo configuration entries without sufficient constraint on what actions or binaries the resulting rules authorize. This allows plugin installation logic to broaden the set of privileged commands executable through sudo beyond what the web interface should be permitted to invoke.

Attack Vector

Exploitation occurs over the network against an authenticated RaspAP session. An attacker with access to the plugin installation feature triggers the sudoers manipulation, then leverages the resulting sudo entries to execute privileged commands. Public proof-of-concept material has been released through a third-party gist, increasing the likelihood of opportunistic exploitation against exposed RaspAP instances.

No verified code example is available for reproduction. Refer to the GitHub Gist PoC Repository and VulDB CVE-2026-101860 entry for published technical details.

Detection Methods for CVE-2026-101860

Indicators of Compromise

Unexpected entries or modifications in /etc/sudoers.d/ files written by the RaspAP web user (typically www-data)
Plugin installation events in RaspAP logs that do not correspond to authorized administrator activity
Execution of privileged system commands originating from the www-data account outside routine RaspAP operations
Outbound network connections initiated by RaspAP processes to unfamiliar hosts following plugin installation events

Detection Strategies

Monitor file integrity on /etc/sudoers, /etc/sudoers.d/, and the RaspAP installation directory for unauthorized changes
Alert on invocations of PluginInstaller::addSudoers and related plugin lifecycle events in RaspAP application logs
Correlate web-authentication events with subsequent sudo rule modifications to identify anomalous administrative activity

Monitoring Recommendations

Enable verbose auditd rules on the RaspAP host covering sudoers files and the raspap-webgui directory
Forward RaspAP web server and PHP-FPM logs to a centralized log platform for correlation and retention
Track process execution chains where the web server user spawns shell interpreters or privileged system utilities

How to Mitigate CVE-2026-101860

Immediate Actions Required

Restrict network access to the RaspAP web interface to trusted management networks only, using firewall rules or VLAN segmentation
Disable or remove the plugin installation feature until a fixed release is available
Audit /etc/sudoers.d/ for entries created by RaspAP and remove any unauthorized rules
Rotate credentials for all RaspAP administrative accounts and enforce strong authentication

Patch Information

No vendor patch is available at the time of publication. The VulDB advisory notes that the RaspAP maintainers were contacted early in the disclosure process but did not respond. Track the RaspAP project for future security releases beyond version 3.5.5.

Workarounds

Limit RaspAP administrative accounts to a minimum set of trusted operators and audit account provisioning
Run RaspAP behind a reverse proxy that enforces additional authentication and IP allow-listing
Remove the sudoers entries associated with PluginInstaller if plugin functionality is not required in your deployment
Consider migrating temporarily to a hardened alternative access point configuration if the environment is internet-exposed

bash

# Configuration example: restrict RaspAP web UI to a management subnet using iptables
sudo iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP

# Audit sudoers entries written by RaspAP
sudo ls -la /etc/sudoers.d/
sudo visudo -c