CVE-2026-42796: Arelle REST Endpoint RCE Vulnerability

CVE-2026-42796 Overview

CVE-2026-42796 is an unauthenticated remote code execution vulnerability in Arelle versions before 2.39.10. The flaw resides in the /rest/configure REST endpoint, which accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization checks. Attackers can supply a URL pointing to a malicious Python file through the plugins parameter. The Arelle webserver then downloads and executes the attacker-controlled code within the Arelle process, inheriting its privileges. The issue is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated network attackers can achieve arbitrary code execution on any exposed Arelle webserver by submitting a single crafted HTTP request.

Affected Products

Arelle XBRL processor versions before 2.39.10
Deployments exposing the Arelle webserver /rest/configure endpoint
Any application or pipeline embedding vulnerable Arelle releases

Discovery Timeline

2026-05-04 - CVE-2026-42796 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-42796

Vulnerability Analysis

Arelle is an open-source XBRL platform that ships with an optional REST webserver. The webserver exposes an administrative endpoint at /rest/configure intended to load plugins dynamically. The endpoint reads a plugins query parameter and passes the value directly to the Arelle plugin manager. The plugin manager treats URL-formatted values as remote plugin sources, retrieves the file over the network, and loads it into the running Python interpreter.

The endpoint enforces no authentication, no authorization, and no allowlist on the plugin source. Any client able to reach the webserver can therefore instruct the server to fetch and execute arbitrary Python code. Execution occurs inside the Arelle process and inherits the privileges of the operating system account running the service.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The /rest/configure handler trusts unauthenticated input and forwards it to a code-loading subsystem. No origin validation, signature verification, or scheme restriction is applied to the supplied URL before the plugin manager imports the downloaded module.

Attack Vector

Exploitation requires only network access to the Arelle webserver. An attacker hosts a malicious Python file on a reachable HTTP server and sends a single GET request to /rest/configure with the plugins parameter set to the hosting URL. The Arelle process retrieves the file, imports it as a plugin, and executes any top-level code it contains. The technical details and remediation commit are documented in the Arelle GitHub Pull Request 2320 and the VulnCheck Advisory on Arelle RCE.

Detection Methods for CVE-2026-42796

Indicators of Compromise

HTTP requests to /rest/configure containing a plugins= query parameter referencing an external URL
Outbound HTTP or HTTPS connections initiated by the Arelle process to unfamiliar hosts immediately after a configure request
New or unexpected Python files materializing in Arelle plugin cache or temporary directories
Child processes spawned by the Arelle interpreter that are inconsistent with normal XBRL processing

Detection Strategies

Inspect webserver and reverse proxy access logs for any request path matching /rest/configure with a plugins parameter, especially from external sources
Alert on Arelle process activity that deviates from baseline, such as shell invocations, network listeners, or credential access
Correlate inbound /rest/configure requests with subsequent egress traffic from the same host within a short time window

Monitoring Recommendations

Capture full URL query strings in HTTP access logs to retain plugins parameter values for forensic review
Forward Arelle host telemetry, including process tree and network connection events, to a centralized analytics platform
Apply file integrity monitoring to Arelle installation directories and plugin paths

How to Mitigate CVE-2026-42796

Immediate Actions Required

Upgrade Arelle to version 2.39.10 or later, available at the Arelle 2.39.10 Release
Restrict network exposure of the Arelle webserver to trusted management networks only
Audit historical access logs for any prior requests to /rest/configure containing a plugins parameter
Rotate credentials and secrets accessible to the Arelle service account if exploitation is suspected

Patch Information

The upstream fix is delivered in Arelle 2.39.10. The remediation, tracked in Arelle Pull Request 2320, removes the unauthenticated plugin-loading path from the REST interface. Operators should deploy the patched release rather than attempting source-level backports.

Workarounds

Block external access to /rest/configure at the reverse proxy or web application firewall until patching is complete
Run the Arelle webserver bound to localhost when REST functionality is required only for local tooling
Execute Arelle under a dedicated low-privilege account with no write access to sensitive paths and restricted egress
Disable the Arelle REST webserver entirely on hosts that do not require it

bash

# Example NGINX rule blocking the vulnerable endpoint
location /rest/configure {
    deny all;
    return 403;
}