CVE-2026-25856: OpenBullet2 RCE Vulnerability

CVE-2026-25856 Overview

CVE-2026-25856 is an authenticated remote code execution vulnerability in OpenBullet2 through version 0.3.2. Authenticated users can execute arbitrary C# code on the server host by creating or modifying job configurations. The plain C# execution mode lacks reference filtering and API restrictions. Attackers can access the file system, spawn processes, and invoke arbitrary .NET APIs as the process user. The flaw is tracked under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Any authenticated OpenBullet2 user can pivot from low-privilege application access to full code execution on the host, including arbitrary process creation and .NET API invocation.

Affected Products

OpenBullet2 versions through 0.3.2
Deployments exposing the job configuration interface to authenticated users
Self-hosted OpenBullet2 web instances with default execution modes enabled

Discovery Timeline

2026-06-08 - CVE-2026-25856 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-25856

Vulnerability Analysis

OpenBullet2 exposes a job configuration interface that accepts C# code blocks executed by the server at runtime. The plain C# execution mode passes user-supplied source directly to the .NET scripting engine without sandboxing, allow-listing of assemblies, or API restrictions. An authenticated user with permission to create or edit jobs can submit C# that loads any reference available to the host process. The submitted code runs in-process with the privileges of the OpenBullet2 service account.

This design exposes the underlying host to the full surface area of the .NET runtime. Attackers can call System.Diagnostics.Process.Start, read or write arbitrary files via System.IO, open outbound network sockets, and load additional assemblies. The combination of network-reachable web UI and unconstrained scripting converts an account compromise or weak authentication into full host compromise.

Root Cause

The root cause is missing input validation and execution sandboxing on user-supplied job logic [CWE-94]. The plain C# execution path does not enforce a deny-list of dangerous namespaces, does not restrict reflection, and does not isolate scripts from the host process. Any code that compiles is executed with full trust.

Attack Vector

Exploitation requires network reachability to the OpenBullet2 web interface and authenticated access to the job configuration endpoint. Public analysis from HackerNoon describes an authentication bypass condition that lowers the practical privilege barrier. Combined with the RCE primitive documented by VulnCheck, an unauthenticated attacker reaching the UI could chain to full code execution.

No verified public proof-of-concept code is included in this advisory. Refer to the linked advisories for technical exploitation details.

Detection Methods for CVE-2026-25856

Indicators of Compromise

Unexpected child processes spawned by the OpenBullet2 process or its .NET host (dotnet.exe, OpenBullet2.Web.exe)
New or modified job configurations containing references to System.Diagnostics, System.IO, System.Reflection, or Process.Start
Outbound network connections originating from the OpenBullet2 service to unfamiliar destinations
Writes to sensitive paths (/etc, C:\Windows\Temp, user profile directories) by the OpenBullet2 service account

Detection Strategies

Monitor process lineage where the OpenBullet2 service is the parent of shells, scripting engines, or LOLBins such as powershell.exe, cmd.exe, bash, or curl.
Inspect web access logs for authenticated POST or PUT requests targeting the job configuration endpoints, especially from accounts with no prior job-edit history.
Audit the OpenBullet2 application database for job definitions containing C# code referencing process, file, or network APIs.

Monitoring Recommendations

Forward OpenBullet2 application logs and host process telemetry to a centralized analytics platform for correlation.
Alert on any failed-then-successful authentication sequence followed by job configuration changes within a short window.
Baseline normal child-process behavior for the OpenBullet2 host and alert on deviations.

How to Mitigate CVE-2026-25856

Immediate Actions Required

Restrict network access to the OpenBullet2 web interface using firewall rules or a reverse proxy with IP allow-listing.
Disable or remove the plain C# execution mode in job configurations where the deployment supports configuration overrides.
Audit existing user accounts and revoke job-edit privileges from any account that does not require them.
Rotate credentials for any account with access to the OpenBullet2 interface and enforce strong authentication.

Patch Information

No fixed version is identified in the NVD record at the time of publication. OpenBullet2 versions through 0.3.2 remain affected. Monitor the VulnCheck advisory and the upstream OpenBullet2 project for patch availability.

Workarounds

Run OpenBullet2 inside a hardened container or virtual machine with minimal host privileges and read-only file system mounts where possible.
Apply operating system-level execution controls such as AppArmor, SELinux, or Windows Defender Application Control to restrict child process creation.
Place the application behind an authenticating reverse proxy that enforces multi-factor authentication independent of the application's own auth layer.
Block outbound network egress from the OpenBullet2 host except to required destinations to limit post-exploitation activity.

bash

# Example: restrict OpenBullet2 web UI to a management subnet using iptables
iptables -A INPUT -p tcp --dport 5000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP