CVE-2026-104474: OpenLiteSpeed Privilege Escalation Flaw

CVE-2026-104474 Overview

CVE-2026-104474 is a local privilege escalation vulnerability in OpenLiteSpeed versions prior to 1.9.3. The flaw resides in admin/misc/lsup.sh, the auto-update script that executes update packages as root without verifying their integrity. The script pulls packages from /usr/local/lsws/autoupdate/, a directory writable by the nobody user that runs the web server process. An attacker who has already compromised the nobody web process can replace the staged update archive before extraction. When the next update runs, the attacker-controlled install.sh executes with root privileges. The weakness is classified as a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367].

Critical Impact
An attacker who gains code execution as the nobody web user can escalate to root by planting a malicious update package in the auto-update staging directory.

Affected Products

OpenLiteSpeed versions prior to 1.9.3
Deployments using the admin/misc/lsup.sh auto-update workflow
Installations with the default /usr/local/lsws/autoupdate/ directory writable by the nobody account

Discovery Timeline

2026-10-03 - CVE-2026-104474 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104474

Vulnerability Analysis

OpenLiteSpeed ships with an administrative auto-update script, lsup.sh, that fetches and installs new server versions. The script downloads an update archive into /usr/local/lsws/autoupdate/, extracts it, and executes the bundled install.sh as root. The staging directory is writable by the nobody user because the web server process must stage downloads there. The script does not validate the package signature, hash, or ownership before extraction. This creates a trust boundary violation: content controlled by a low-privileged user is executed by a root process. The vulnerability requires prior code execution as the nobody user and user interaction to trigger the update cycle, which constrains exploitation to multi-stage attack chains.

Root Cause

The root cause is a Time-of-Check Time-of-Use race condition in lsup.sh combined with insecure directory permissions. The update script treats files in the nobody-writable /usr/local/lsws/autoupdate/ path as trusted inputs. Between the moment the update package is fetched and the moment install.sh is executed as root, an attacker with nobody privileges can overwrite the archive. The fix landed in commit 468523ce84388cea9ba6633c26517bc05b3e2bc1 and shipped in OpenLiteSpeed 1.9.3.

Attack Vector

Exploitation requires local access and prior compromise of the OpenLiteSpeed web server process. The attacker, running as nobody, writes a crafted archive containing a malicious install.sh into /usr/local/lsws/autoupdate/. When an administrator or scheduled task triggers lsup.sh, the script extracts the attacker-controlled archive and runs install.sh with root privileges. The attacker gains full root code execution on the host. See the VulnCheck Advisory for OpenLiteSpeed and the vulnerable lsup.sh source for the specific code path.

// No verified exploit code published. See VulnCheck advisory and
// the lsup.sh source reference for the vulnerable code path.

Detection Methods for CVE-2026-104474

Indicators of Compromise

Unexpected files or archives appearing in /usr/local/lsws/autoupdate/ outside of scheduled update windows
Modifications to install.sh or extracted update contents owned by the nobody user
Root processes spawned as children of lsup.sh that deviate from the standard OpenLiteSpeed installer workflow
New SUID binaries, cron entries, or systemd units created shortly after an auto-update run

Detection Strategies

Monitor process ancestry for lsup.sh invocations that spawn shells, package managers, or network utilities as root
Alert on write operations to /usr/local/lsws/autoupdate/ performed by the nobody user outside the download step
Baseline the hash of OpenLiteSpeed update archives against vendor-published checksums before extraction

Monitoring Recommendations

Enable file integrity monitoring on /usr/local/lsws/ and the autoupdate subdirectory
Capture auditd rules for execve events where the parent is lsup.sh and record the full command line
Forward web server process telemetry and shell execution events to a centralized logging platform for retroactive hunting

How to Mitigate CVE-2026-104474

Immediate Actions Required

Upgrade OpenLiteSpeed to version 1.9.3 or later as documented in the OpenLiteSpeed Release Log 1.9.x
Audit /usr/local/lsws/autoupdate/ for unexpected archives or scripts and remove untrusted content
Review recent root-level process execution for signs of exploitation prior to patching

Patch Information

The vendor fix is published in commit 468523ce84388cea9ba6633c26517bc05b3e2bc1 and included in OpenLiteSpeed 1.9.3. The patch hardens how lsup.sh handles update packages so that content staged by the nobody user is no longer blindly executed as root. Administrators should apply the official 1.9.3 release rather than back-porting the script change manually.

Workarounds

Restrict write access to /usr/local/lsws/autoupdate/ so that the nobody user cannot place files there, and run updates from a staging directory owned by root
Disable the auto-update workflow and perform manual, signature-verified upgrades until patching is complete
Harden the OpenLiteSpeed service account to limit lateral movement if the nobody process is compromised

bash

# Configuration example: restrict the autoupdate staging directory
chown -R root:root /usr/local/lsws/autoupdate
chmod 700 /usr/local/lsws/autoupdate