CVE-2026-26422: Clash Verge Service IPC LPE Vulnerability

CVE-2026-26422 Overview

CVE-2026-26422 affects clash-verge-service-ipc versions prior to 2.3.0. The component exposes a world-reachable inter-process communication (IPC) endpoint, allowing any local user to interact with a privileged service. This design flaw enables local privilege escalation on systems running the vulnerable Clash Verge service. The weakness is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource. The maintainers addressed the issue in the v2.3.0 release of the clash-verge-service-ipc project.

Critical Impact
A local unprivileged user can reach the IPC endpoint and escalate privileges, achieving high impact to confidentiality, integrity, and availability on the affected host.

Affected Products

clash-verge-service-ipc versions before 2.3.0
Clash Verge Rev installations bundling the vulnerable IPC service
Desktop systems where the privileged Clash Verge service is installed and running

Discovery Timeline

2026-06-06 - CVE-2026-26422 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-26422

Vulnerability Analysis

Clash Verge installs a background service that runs with elevated privileges to manage proxy configuration, network routes, and system-level settings. The service communicates with the user-facing application through an IPC endpoint provided by the clash-verge-service-ipc crate. In versions prior to 2.3.0, the endpoint accepts connections from any local user without verifying caller identity or membership in a privileged group.

Because the endpoint exposes administrative operations, an unprivileged process on the same host can invoke service routines that execute under the privileged context. This converts local code execution as a standard user into local code execution at the service's privilege level, satisfying the conditions for privilege escalation described in the advisory and referenced KaguraNaku CVE Analysis.

Root Cause

The root cause is incorrect permission assignment on the IPC channel. The service binds the endpoint with permissions that make it reachable by all local principals, and it does not enforce authentication on incoming requests. This matches the [CWE-732] pattern: a critical resource is assigned permissions that allow access by unintended actors.

Attack Vector

An attacker requires local access to a host running the vulnerable service. The attacker connects to the IPC endpoint from a standard user session and issues commands that the privileged service executes on the caller's behalf. No user interaction and no prior privileges are needed, and exploitation does not depend on network access.

text

// Patch reference: src-tauri/Cargo.toml dependency bump
tauri-plugin-mihomo = { git = "https://github.com/clash-verge-rev/tauri-plugin-mihomo" }
clash_verge_logger = { git = "https://github.com/clash-verge-rev/clash-verge-logger" }
async-trait = "0.1.89"
-clash_verge_service_ipc = { version = "2.0.26", features = [
+clash_verge_service_ipc = { version = "2.0.27", features = [
   "client",
], git = "https://github.com/clash-verge-rev/clash-verge-service-ipc" }
arc-swap = "1.8.0"

Source: GitHub Commit Update. The patch bumps the clash_verge_service_ipc dependency to a fixed version that restricts IPC access.

Detection Methods for CVE-2026-26422

Indicators of Compromise

Connections to the Clash Verge service IPC endpoint originating from processes that are not the Clash Verge desktop application
Spawning of administrative child processes by the Clash Verge service shortly after IPC traffic from a non-standard client
Unexpected modifications to system proxy, routing, or network configuration performed by the Clash Verge service
Installed versions of clash-verge-service-ipc reported as less than 2.3.0

Detection Strategies

Inventory all hosts running Clash Verge Rev and identify the bundled clash-verge-service-ipc version against the fixed v2.3.0 release.
Hunt for non-application processes that open the IPC named pipe or Unix domain socket used by the Clash Verge service.
Correlate child processes created by the privileged Clash Verge service with the parent that triggered the IPC request, flagging unexpected callers.

Monitoring Recommendations

Enable process-creation and IPC-access logging on endpoints where Clash Verge is permitted, and forward events to a central analytics platform.
Alert when the Clash Verge service performs privileged actions outside of expected user-driven workflows.
Track software inventory changes so downgrades to vulnerable clash-verge-service-ipc versions are detected.

How to Mitigate CVE-2026-26422

Immediate Actions Required

Upgrade Clash Verge Rev to a build that includes clash-verge-service-ipc version 2.3.0 or later, as published in the GitHub Release v2.3.0.
Inventory endpoints for installations of Clash Verge and prioritize multi-user or shared hosts for patching first.
Restrict installation of Clash Verge to systems where local privilege escalation risk has been reviewed.

Patch Information

The fix is delivered through the GitHub Commit Update in the Clash Verge Rev repository, which updates the clash_verge_service_ipc dependency. The corresponding upstream release is documented at GitHub Release v2.3.0. Apply vendor-provided installer builds that incorporate the updated dependency.

Workarounds

Stop and disable the Clash Verge background service on hosts where multiple users have shell access until the patched version is deployed.
Limit local logon rights on systems running Clash Verge so only trusted administrators can reach the IPC endpoint.
Uninstall Clash Verge from shared workstations and servers where the proxy functionality is not required.

bash

# Verify the installed clash-verge-service-ipc version meets the fixed release
grep -R "clash_verge_service_ipc" ./src-tauri/Cargo.toml
# Expected: clash_verge_service_ipc = { version = "2.0.27", ... } or newer
# Linux: stop the service while patching
sudo systemctl stop clash-verge-service
sudo systemctl disable clash-verge-service