CVE-2026-39087: Ntfy RCE Vulnerability via parseActions

CVE-2026-39087 Overview

A critical remote code execution vulnerability has been identified in Ntfy ntfy.sh, a popular open-source push notification service. The vulnerability exists in the parseActions function and allows remote attackers to execute arbitrary code on affected systems without requiring any authentication or user interaction.

Critical Impact

This vulnerability enables unauthenticated remote attackers to achieve full system compromise by exploiting improper input handling in the parseActions function, potentially leading to complete server takeover.

Affected Products

• Ntfy ntfy.sh versions prior to v.2.21

Discovery Timeline

• April 23, 2026 - CVE-2026-39087 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-39087

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code, also known as Code Injection). The flaw resides in the parseActions function within the Ntfy notification service, which fails to properly sanitize or validate user-supplied input before processing it. This allows attackers to inject and execute arbitrary code on the target system.

The network-accessible nature of this vulnerability, combined with the lack of authentication requirements and no need for user interaction, makes it particularly dangerous for organizations running vulnerable Ntfy instances. Successful exploitation grants attackers the ability to compromise confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2026-39087 stems from insufficient input validation and sanitization within the parseActions function. When processing notification action parameters, the function fails to adequately filter malicious payloads, allowing crafted input to be interpreted and executed as code. This code injection vulnerability occurs because user-controlled data flows into code execution paths without proper neutralization of special elements.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no privileges or user interaction. An attacker can remotely target any exposed Ntfy instance by sending specially crafted requests that contain malicious payloads targeting the parseActions function. The low attack complexity means that exploitation is straightforward once an attacker identifies a vulnerable target.

The exploitation flow involves:

1. Identifying a vulnerable Ntfy instance (versions before v.2.21)
2. Crafting a malicious request containing code injection payload
3. Sending the request to the target's parseActions endpoint
4. Achieving arbitrary code execution on the server

For technical details on exploitation techniques, refer to the GitHub Gist Exploit Code published by security researchers.

Detection Methods for CVE-2026-39087

Indicators of Compromise

• Unusual outbound network connections from Ntfy server processes
• Unexpected child processes spawned by the Ntfy service
• Anomalous entries in Ntfy application logs related to action parsing
• Unauthorized modifications to system files or configurations on the Ntfy host

Detection Strategies

• Monitor HTTP requests to Ntfy endpoints for malformed or suspicious action parameters
• Implement application-layer firewalls to inspect and filter requests containing potential code injection payloads
• Deploy runtime application self-protection (RASP) solutions to detect code injection attempts
• Configure SIEM rules to alert on anomalous Ntfy service behavior

Monitoring Recommendations

• Enable verbose logging on Ntfy instances to capture detailed request information
• Set up alerts for any code execution attempts or unusual process spawning from the Ntfy service
• Monitor system calls and file operations performed by the Ntfy process
• Implement network traffic analysis to detect potential exploitation attempts

How to Mitigate CVE-2026-39087

Immediate Actions Required

• Upgrade Ntfy ntfy.sh to version 2.21 or later immediately
• If immediate patching is not possible, consider temporarily taking vulnerable instances offline
• Restrict network access to Ntfy services using firewall rules to limit exposure
• Review access logs for signs of exploitation attempts

Patch Information

The vulnerability has been addressed in Ntfy version 2.21. Organizations should upgrade to this version or later to remediate the vulnerability. For additional information about the affected service, refer to the Ntfy Notification Service and NtfySH Service Overview resources.

Workarounds

• Implement network segmentation to isolate Ntfy instances from untrusted networks
• Deploy a web application firewall (WAF) with rules to block code injection patterns
• Disable or restrict the actions functionality if not required for operations
• Use reverse proxy configurations to filter potentially malicious requests before they reach the Ntfy service

# Example: Restrict access to Ntfy using iptables
# Allow only trusted IP ranges to access Ntfy service
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP