CVE-2026-110392: Samsung QA-Board OS Command Injection RCE

CVE-2026-110392 Overview

CVE-2026-110392 is an OS command injection vulnerability in Samsung Open Source QA-Board, an open-source quality assurance dashboard used for tracking algorithm and machine learning experiments. The flaw stems from improper neutralization of special elements passed to shell commands in the application's redo and tuning backend actions. An unauthenticated remote attacker can craft input that breaks out of the intended command context and executes arbitrary operating system commands on the server. Successful exploitation leads to full compromise of the host running the QA-Board backend, including the ability to read, modify, or destroy project data and pivot into connected build infrastructure.

Critical Impact
Unauthenticated remote attackers can inject arbitrary OS commands into the QA-Board backend, achieving full remote code execution on the host.

Affected Products

Samsung QA-Board (open source) backend/backend/__init__.py and backend/backend/api/auth.py prior to commit 05789e6
QA-Board deployments exposing the redo and tuning API endpoints
Instances relying on the hardcoded default SECRET_KEY for session signing

Discovery Timeline

2026-10-14 - CVE-2026-110392 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110392

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. QA-Board's backend passes user-controlled parameters from the redo and tuning endpoints into shell command execution without proper sanitization. Because shell metacharacters are not neutralized, an attacker can append or substitute additional commands that the server executes with the privileges of the QA-Board process.

Compounding the issue, the backend previously shipped with a hardcoded default secret_key used to sign Flask session cookies. Any attacker aware of that default could forge sessions and authenticate as any user, further lowering the bar for exploitation. The upstream fix addresses both the injection and the authentication weakness in a single commit.

Root Cause

The root cause is unsafe construction of shell command strings from HTTP request parameters inside the redo and tuning handlers, combined with missing authentication on action endpoints. Input flowed directly into a shell invocation, so characters such as ;, |, &&, and backticks were interpreted by the shell rather than treated as literal arguments.

Attack Vector

Exploitation is network-based and requires no user interaction. An attacker sends a crafted HTTP request to the vulnerable redo or tuning endpoint containing shell metacharacters in a parameter that is incorporated into a backend command. On a vulnerable instance, the injected payload runs under the QA-Board service account, yielding code execution on the server.

python

# Patch excerpt from backend/backend/__init__.py
# Replaces a hardcoded default SECRET_KEY with a generated per-install key
def _secret_key():
    """
    Anyone knowing the key can forge sessions and log in as anyone,
    so we never use a hardcoded default.
    If $SECRET_KEY is not set, we generate a key once and save it,
    so sessions survive restarts.
    """
    if os.environ.get('SECRET_KEY'):
        return os.environ['SECRET_KEY']
    import secrets
    from .config import qaboard_data_dir
    key_path = qaboard_data_dir / 'secret_key'
    try:
        fd = os.open(key_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
        with os.fdopen(fd, 'w') as f:
            f.write(secrets.token_hex(32))
    except FileExistsError:
        pass
    import time
    for _ in range(50):  # another worker may be writing it
        key = key_path.read_text().strip()
        if key:
            return key
        time.sleep(0.1)
    raise RuntimeError(f"Empty {key_path}")

app.secret_key = _secret_key()
# Source: https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707

python

# Patch excerpt from backend/backend/api/auth.py
# Adds login enforcement decorator so action endpoints require authentication
import os
from datetime import timedelta
from functools import wraps

import yaml
import ldap
import simplejson
from flask import request, jsonify, redirect, session, g
from flask_login import LoginManager, login_user, logout_user, current_user
from werkzeug.security import generate_password_hash, check_password_hash
# Source: https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707

Detection Methods for CVE-2026-110392

Indicators of Compromise

HTTP requests to QA-Board redo or tuning endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks in parameter values
Unexpected child processes spawned by the QA-Board Python/Flask backend (for example, sh, bash, curl, wget, nc)
Outbound network connections from the QA-Board host to unknown IPs shortly after an action API call
New or modified files under the QA-Board data directory that were not created by legitimate CI jobs

Detection Strategies

Inspect reverse proxy and application logs for action endpoint parameters containing shell control characters or encoded equivalents (%3B, %7C, %26%26)
Correlate QA-Board process ancestry: any shell interpreter spawned from the backend worker that is not part of a known build command should be treated as suspicious
Alert on authentication activity using default or weak Flask session cookies, indicating the pre-patch hardcoded SECRET_KEY is still in use

Monitoring Recommendations

Enable verbose request logging on the QA-Board backend and forward logs to a centralized SIEM for retention and query
Monitor file integrity for backend/backend/__init__.py, backend/backend/api/auth.py, and the on-disk secret_key file
Track egress traffic from QA-Board hosts and baseline normal destinations so anomalous callbacks surface quickly

How to Mitigate CVE-2026-110392

Immediate Actions Required

Upgrade QA-Board to a build that includes commit 05789e67c5d022f2403b9340fc8d82dc99dc3707 or later
Restrict network exposure of the QA-Board backend to trusted internal networks or VPN until the patch is applied
Rotate any Flask session SECRET_KEY that was previously set to the hardcoded default, and invalidate existing sessions
Review backend logs for prior exploitation attempts against redo and tuning endpoints

Patch Information

The upstream fix is published as a single commit in the Samsung QA-Board repository. The patch sanitizes command construction in the redo and tuning paths, enforces authentication on action endpoints through a login_required-style decorator in auth.py, and replaces the hardcoded SECRET_KEY default with a per-install generated key stored under the QA-Board data directory. See the GitHub commit for QA-Board for the complete diff and file-level changes.

Workarounds

Place the QA-Board backend behind an authenticating reverse proxy that blocks unauthenticated access to redo and tuning routes
Add a web application firewall rule that rejects requests whose parameters contain shell metacharacters targeting those endpoints
Run the QA-Board service under a dedicated low-privilege account with no shell access and no write permissions outside its data directory

bash

# Example: pin QA-Board to the patched commit and set a strong SECRET_KEY
cd /opt/qaboard
git fetch --all
git checkout 05789e67c5d022f2403b9340fc8d82dc99dc3707

# Generate and export a strong secret key before starting the backend
export SECRET_KEY="$(python -c 'import secrets; print(secrets.token_hex(32))')"

# Restart the service so the new code and key take effect
systemctl restart qaboard-backend