CVE-2026-26720: Twenty CRM RCE Vulnerability Explained

CVE-2026-26720 Overview

A critical remote code execution (RCE) vulnerability exists in Twenty CRM version 1.15.0 and earlier. The vulnerability resides in the local.driver.ts module, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. Twenty CRM is an open-source CRM platform, and this vulnerability poses a significant risk to organizations running self-hosted instances.

Critical Impact
Remote attackers can achieve complete system compromise through arbitrary code execution without requiring authentication, potentially leading to full control of the CRM server, data exfiltration, and lateral movement within the network.

Affected Products

Twenty CRM v1.15.0 and earlier versions
Self-hosted Twenty CRM deployments
Twenty Twenty (all versions prior to security patch)

Discovery Timeline

2026-03-02 - CVE-2026-26720 published to NVD
2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-26720

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw exists within the local.driver.ts module of Twenty CRM, which handles local storage operations. The vulnerability allows attackers to inject and execute arbitrary code through the network without requiring any authentication or user interaction.

The code injection vulnerability enables attackers to craft malicious requests that bypass input validation mechanisms in the local.driver.ts module. Once the malicious payload reaches the vulnerable code path, it is processed and executed within the context of the Twenty CRM application, granting the attacker the same privileges as the application process.

For detailed technical analysis, refer to the Dillon Kirsch RCE Analysis.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization within the local.driver.ts module. The module fails to adequately validate or sanitize user-supplied input before processing it, allowing attackers to inject malicious code that is subsequently executed by the application. This is a classic code injection pattern where untrusted data is interpreted as executable code.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can remotely send specially crafted requests to the vulnerable Twenty CRM instance targeting the local.driver.ts module. The attack has low complexity, meaning it can be executed without specialized conditions or prerequisites beyond network access to the target system.

A proof-of-concept demonstrating this attack is available at the GitHub PoC repository for CVE-2026-26720.

Detection Methods for CVE-2026-26720

Indicators of Compromise

Unusual outbound network connections from the Twenty CRM server to unknown external hosts
Unexpected processes spawned by the Twenty CRM application or Node.js runtime
Anomalous file system modifications in Twenty CRM installation directories
Suspicious HTTP requests targeting the local.driver.ts module endpoints
Unexpected system resource utilization patterns on the CRM server

Detection Strategies

Monitor HTTP request logs for unusual payloads targeting storage-related API endpoints
Implement application-layer firewalls to inspect and filter requests containing code injection patterns
Deploy endpoint detection and response (EDR) solutions to identify post-exploitation behaviors
Analyze process execution chains to detect anomalous child processes from the Twenty CRM application

Monitoring Recommendations

Enable verbose logging for the Twenty CRM application and review logs regularly
Set up alerts for any attempts to access or modify the local.driver.ts module
Monitor network traffic for data exfiltration attempts from the CRM server
Implement file integrity monitoring on critical Twenty CRM application files

How to Mitigate CVE-2026-26720

Immediate Actions Required

Upgrade Twenty CRM to the latest patched version immediately
If patching is not immediately possible, restrict network access to the Twenty CRM instance
Place the Twenty CRM server behind a web application firewall (WAF) with code injection rules enabled
Conduct a security audit to identify any signs of compromise on affected systems
Review access logs to determine if exploitation attempts have occurred

Patch Information

Organizations should check the Twenty CRM official website and official release channels for security patches addressing this vulnerability. Apply all available security updates as soon as possible. For detailed patch information and remediation guidance, refer to the security analysis by Dillon Kirsch.

Workarounds

Restrict network access to the Twenty CRM instance to trusted IP addresses only
Implement network segmentation to isolate the CRM server from critical infrastructure
Disable or restrict access to the local.driver.ts module functionality if not required
Deploy a reverse proxy with strict input validation rules in front of the application
Consider temporarily taking affected instances offline until patches can be applied

bash

# Example: Restrict access to Twenty CRM via iptables
# Allow access only from trusted management IP
iptables -A INPUT -p tcp --dport 3000 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

# Example: Nginx reverse proxy configuration to block suspicious requests
# Add to location block for Twenty CRM
location / {
    # Block requests with common code injection patterns
    if ($request_body ~* "(eval|exec|spawn|child_process)") {
        return 403;
    }
    proxy_pass http://localhost:3000;
}