CVE-2026-28280: osctrl-admin Stored XSS Vulnerability

CVE-2026-28280 Overview

CVE-2026-28280 is a stored cross-site scripting (XSS) vulnerability in osctrl, an osquery management solution. The vulnerability exists in the osctrl-admin on-demand query list functionality, allowing attackers with query-level permissions to inject arbitrary JavaScript code via the query parameter. This malicious payload is stored and subsequently executes in the browser of any user—including administrators—who visits the query list page. When combined with CSRF token extraction techniques, this vulnerability can be chained to escalate privileges and perform actions as the authenticated user, potentially leading to full platform compromise.

Critical Impact
An attacker with the lowest privilege tier (query-level permissions) can execute arbitrary JavaScript in the browsers of all users who view the query list. If an administrator's session executes the malicious payload, this can lead to complete platform compromise.

Affected Products

osctrl versions prior to 0.5.0
osctrl-admin component (on-demand query list feature)

Discovery Timeline

2026-02-26 - CVE-2026-28280 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28280

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) arises from improper input validation and output encoding in the osctrl-admin web interface. When a user with query-level permissions submits an on-demand query, the application fails to properly sanitize the query parameter input before storing it in the database. Subsequently, when any user navigates to the query list page, the stored malicious payload is rendered without proper encoding, causing the injected JavaScript to execute within the victim's browser context.

The vulnerability is particularly concerning because query-level permissions represent the lowest privilege tier in osctrl's access control model. This means even users with minimal access rights can inject persistent malicious scripts that target all other users of the platform, including those with administrative privileges.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization on the query parameter during submission and insufficient output encoding when rendering stored queries on the query list page. The application trusts user-supplied input and reflects it directly into the HTML response without applying context-appropriate encoding, creating a classic stored XSS condition.

Attack Vector

The attack vector is network-based and requires the attacker to have authenticated access with at least query-level permissions. The attack unfolds in the following sequence:

An attacker with query-level permissions crafts a malicious on-demand query containing JavaScript code within the query parameter
The malicious payload is submitted through the osctrl-admin interface and stored in the application database
When any authenticated user (including administrators) visits the query list page, the stored payload executes in their browser
The attacker can chain this with CSRF token extraction to perform privileged actions as the victim user
If an administrator triggers the payload, the attacker can potentially create new admin accounts or modify system configurations

The vulnerability does not require user interaction beyond the victim visiting the query list page, which is a common administrative action in osctrl deployments.

Detection Methods for CVE-2026-28280

Indicators of Compromise

Unusual JavaScript code patterns in query list entries (e.g., <script> tags, event handlers like onerror, onload)
Queries containing encoded script payloads or obfuscated JavaScript
Unexpected administrator account creation or privilege escalation events
Anomalous API calls or configuration changes following query list page visits

Detection Strategies

Implement web application firewall (WAF) rules to detect and block XSS payloads in query submissions
Monitor application logs for queries containing HTML tags or JavaScript event handlers
Deploy browser-based XSS detection extensions for security team browsers
Review database records in the query storage tables for suspicious content patterns

Monitoring Recommendations

Enable detailed logging for all query submission and modification events
Configure alerts for new administrator account creation or privilege changes
Monitor for unusual session activity following query list page access
Implement Content Security Policy (CSP) headers to restrict inline script execution

How to Mitigate CVE-2026-28280

Immediate Actions Required

Upgrade osctrl to version 0.5.0 or later immediately
Audit existing query list entries for potentially malicious payloads
Review osctrl user accounts for any unauthorized administrators that may have been created through exploitation
Restrict query-level permissions to trusted users only until patching is complete

Patch Information

The vulnerability is fixed in osctrl version 0.5.0. The fix was implemented through two pull requests that address the input validation and output encoding issues:

For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-4rv8-5cmm-2r22.

Workarounds

Restrict query-level permissions to only trusted users within the organization
Manually monitor the query list for suspicious payloads containing script tags or JavaScript code
Conduct a security review of osctrl user accounts to identify and remove unauthorized administrators
Implement Content Security Policy headers to mitigate the impact of any injected scripts
Consider temporarily disabling the on-demand query feature until patching is complete

bash

# Upgrade osctrl to the patched version
# Pull the latest release from the official repository
git fetch --tags
git checkout v0.5.0

# Rebuild and redeploy osctrl-admin
make build
# Follow your deployment process to update the running instance