CVE-2026-12196: HestiaCP Privilege Escalation Vulnerability

CVE-2026-12196 Overview

CVE-2026-12196 is a broken access control vulnerability in the HestiaCP control panel cronjob feature. Low-privilege users can modify the panel cronjob to execute HestiaCP management scripts with passwordless sudo. Successful exploitation results in takeover of administrator accounts and the underlying web server. The issue is tracked under [CWE-287] and carries a CVSS v4.0 score of 8.3. Public technical details are available in the Project Black Blog Post and the upstream fix in GitHub Pull Request #5440.

Critical Impact
Low-privilege HestiaCP users can escalate to root on the host and take over administrator accounts through cronjob abuse.

Affected Products

HestiaCP control panel (cronjob feature)
Deployments exposing panel accounts to untrusted users
Shared hosting environments running HestiaCP

Discovery Timeline

2026-07-04 - CVE-2026-12196 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-12196

Vulnerability Analysis

HestiaCP allows panel users to define scheduled cronjobs through the web interface. The cronjob feature does not enforce access control boundaries on the commands a low-privilege user can schedule. Because HestiaCP management scripts are configured to run with passwordless sudo, an attacker with any authenticated panel account can schedule a job invoking privileged management scripts. The scheduled command executes as root when the cron daemon dispatches it. This turns any low-privilege panel account into a foothold for full host compromise, including reset of administrator credentials, extraction of hosted site data, and lateral movement across tenants on shared hosting deployments.

Root Cause

The root cause is broken access control in the cronjob handler. HestiaCP trusts the authenticated user to specify arbitrary command payloads for scheduled execution without validating whether that user is authorized to invoke privileged management scripts. Combined with the passwordless sudo configuration for HestiaCP scripts, the authorization gap collapses the boundary between panel-user context and root context.

Attack Vector

The attack requires network access to the HestiaCP panel and valid low-privilege credentials. The attacker authenticates, navigates to the cronjob feature, and submits a job entry whose command invokes a HestiaCP management script wrapped in sudo. When the scheduled interval elapses, the cron daemon executes the payload with root privileges. See the Project Black Blog Post for the detailed exploitation walk-through and the upstream patch for the corrective changes.

Detection Methods for CVE-2026-12196

Indicators of Compromise

Cronjob entries created by non-admin panel users that reference HestiaCP management scripts under /usr/local/hestia/bin/.
Unexpected invocations of sudo by the panel user account in /var/log/auth.log or journalctl output.
New or modified administrator accounts, SSH keys, or password hashes appearing shortly after low-privilege cron executions.
Outbound network connections initiated by processes spawned from cron running as root.

Detection Strategies

Audit the HestiaCP cronjob database and compare scheduled commands against an allowlist of expected user-space binaries.
Correlate panel authentication events with subsequent cronjob creation and root-level process executions.
Alert when any process launched by cron on behalf of a non-admin user transitions to UID 0.

Monitoring Recommendations

Forward /var/log/auth.log, /var/log/syslog, and HestiaCP panel logs to a centralized log platform for correlation.
Monitor filesystem changes to /usr/local/hestia/data/users/*/cron.conf for entries invoking sudo or management scripts.
Track privilege transitions (setuid to root) originating from cron child processes and flag deviations from baseline.

How to Mitigate CVE-2026-12196

Immediate Actions Required

Upgrade HestiaCP to the release containing the fix from Pull Request #5440.
Review all existing cronjob entries for non-admin users and remove any invoking sudo or HestiaCP management scripts.
Rotate administrator credentials and audit /etc/sudoers.d/ entries related to HestiaCP.

Patch Information

The HestiaCP maintainers addressed the flaw in GitHub Pull Request #5440, which restricts the commands a panel user can schedule through the cronjob feature. Administrators should apply the upstream release that incorporates this pull request and restart the panel service.

Workarounds

Disable the cronjob feature for non-administrator roles until the patched release is deployed.
Restrict panel access to trusted networks using firewall rules or reverse-proxy allowlists.
Tighten the passwordless sudo configuration for HestiaCP scripts so that user-controlled arguments cannot be passed through.

bash

# Example: temporarily restrict access to the HestiaCP panel to trusted IPs
sudo ufw allow from 203.0.113.0/24 to any port 8083 proto tcp
sudo ufw deny 8083/tcp

# Review existing cronjobs per user for suspicious sudo invocations
grep -R "sudo" /usr/local/hestia/data/users/*/cron.conf