CVE-2026-49819: UpSnap Privilege Escalation Vulnerability

CVE-2026-49819 Overview

CVE-2026-49819 is a missing-authentication vulnerability in UpSnap, an open-source wake-on-LAN web application. The flaw resides in the pb.HandlerInitSuperuser function at backend/pb/handlers.go:249, exposed through the POST /api/upsnap/init-superuser endpoint. Versions 4.4.1 through 5.3.5 are affected. An unauthenticated network-adjacent attacker can register the initial superuser account, obtain a long-lived JSON Web Token (JWT), and pivot to command execution through the wake handler. Version 5.4.0 resolves the issue.

Critical Impact
Unauthenticated attackers can seize superuser control of UpSnap and achieve root-level remote code execution via /bin/sh invocation in the wake command handler.

Affected Products

UpSnap versions 4.4.1 through 5.3.5
UpSnap backend/pb/handlers.goHandlerInitSuperuser
UpSnap backend/networking/wake.goexec.CommandContext sink

Discovery Timeline

2026-08-13 - CVE-2026-49819 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-49819

Vulnerability Analysis

UpSnap exposes an initialization route intended to create the first superuser account after installation. The handler at backend/pb/handlers.go:249 gates access only with a totalSuperusers > 0 count check. It does not enforce authentication, a setup token, an IP allow-list, or rate limiting.

This logic fails open on any fresh installation where no superuser exists. Beyond fresh installs, the check is the sole authorization control on a state-changing administrative endpoint. An attacker who reaches the endpoint before a legitimate operator completes setup wins the race and takes ownership of the deployment.

After creating the initial superuser, the attacker receives a long-lived JWT. That token grants access to authenticated endpoints, including the wake handler at backend/networking/wake.go:43, which invokes exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd). This sink executes shell strings composed from device configuration, enabling root remote code execution on the host running UpSnap.

Root Cause

The root cause is a missing authentication control on a privileged setup endpoint combined with an OS command injection sink [CWE-78] in the wake command executor. The totalSuperusers > 0 guard reflects a business-logic assumption that setup happens only once, without cryptographic proof of operator identity. The wake handler compounds the impact by passing attacker-controlled strings to /bin/sh -c.

Attack Vector

Exploitation requires only network reachability to the UpSnap HTTP interface. The attacker issues a single POST /api/upsnap/init-superuser request containing chosen credentials. If no superuser exists, the server creates the account and returns a JWT. The attacker then authenticates, configures a device with a shell-injection payload in the wake command field, and triggers the wake action to execute arbitrary commands as the UpSnap process user.

Refer to the GitHub Security Advisory GHSA-w4jr-728f-5jhq for the vendor's technical write-up.

Detection Methods for CVE-2026-49819

Indicators of Compromise

Unexpected POST /api/upsnap/init-superuser requests in web server or reverse proxy access logs, especially from external or unfamiliar source addresses.
Creation of superuser accounts that do not correspond to any operator action or change-management ticket.
Child processes of the UpSnap binary spawning /bin/sh -c with commands unrelated to legitimate wake-on-LAN utilities such as wakeonlan or etherwake.
Outbound network connections or file writes originating from the UpSnap process user shortly after wake actions.

Detection Strategies

Alert on any HTTP request path matching /api/upsnap/init-superuser after initial deployment is complete.
Correlate superuser creation events with subsequent JWT issuance and device configuration changes within a short time window.
Baseline the command lines executed by the UpSnap process and flag deviations that include shell metacharacters or unexpected binaries.

Monitoring Recommendations

Forward UpSnap application logs and host process telemetry to a centralized logging pipeline for retention and search.
Monitor authentication events for newly created superuser accounts and long-lived JWT issuance patterns.
Track egress connections from hosts running UpSnap to identify post-exploitation callbacks.

How to Mitigate CVE-2026-49819

Immediate Actions Required

Upgrade all UpSnap instances to version 5.4.0 or later, which removes the unauthenticated init-superuser path.
Audit the superuser account list and revoke any account not created by an authorized operator.
Invalidate existing JWTs by rotating the signing secret and forcing re-authentication.
Review device configurations for wake commands containing shell metacharacters or unexpected binaries and remove them.

Patch Information

The maintainer released the fix in UpSnap 5.4.0. Operators running any version from 4.4.1 through 5.3.5 must upgrade. No official backported patches exist for earlier release branches.

Workarounds

Place UpSnap behind an authenticating reverse proxy that blocks /api/upsnap/init-superuser from all sources after initial setup.
Restrict network access to the UpSnap listener with host firewall rules or network segmentation, limiting reachability to a management VLAN.
Run UpSnap as an unprivileged user with a restricted shell to reduce the blast radius of command execution through the wake handler.

bash

# Example nginx snippet to block the vulnerable endpoint at the proxy
location = /api/upsnap/init-superuser {
    deny all;
    return 403;
}