CVE-2026-53611 Overview
CVE-2026-53611 is an OS Command Injection vulnerability [CWE-78] in Looking Glass, a stateless network-diagnostic platform written in Go. The platform fronts a fleet of routers over SSH and exposes ping, traceroute, and BGP lookup functions through a ConnectRPC gRPC API, an embedded SvelteKit web UI, and the lg-cli client. The flaw stems from an unanchored regular expression in the input validation layer. Attackers can supply crafted input that passes validation while injecting operating system commands executed on the underlying host or routers. Maintainers patched the issue in version 1.3.5.
Critical Impact
Unauthenticated attackers can inject arbitrary OS commands over the network, achieving full compromise of confidentiality, integrity, and availability on affected Looking Glass instances.
Affected Products
- Looking Glass (AS203038) versions prior to 1.3.5
- Deployments exposing the ConnectRPC gRPC API
- Deployments exposing the SvelteKit web UI or lg-cli client
Discovery Timeline
- 2026-09-02 - CVE-2026-53611 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-53611
Vulnerability Analysis
Looking Glass validates user-supplied diagnostic parameters, such as target hosts for ping, traceroute, and BGP queries, using regular expressions before forwarding them to router SSH sessions. The validation regular expression is not anchored with ^ and $ metacharacters. As a result, the regex matches a valid substring anywhere in the input while ignoring surrounding malicious content. Attackers append shell metacharacters, command separators, or backtick-delimited subcommands after a benign IP address or hostname. The unsanitized payload flows into a command constructed for the SSH session or local shell, where the injected content executes with the privileges of the Looking Glass process.
Root Cause
The root cause is improper input validation caused by an unanchored regular expression. Without ^ and $ anchors, the regex engine accepts any string that contains a matching subsequence. This design allows attacker-controlled data to bypass the validation layer while still reaching the command construction logic downstream, satisfying the classic [CWE-78] pattern of failing to neutralize special elements used in an OS command.
Attack Vector
Exploitation requires network access to the Looking Glass gRPC endpoint, web UI, or CLI interface. No authentication or user interaction is required. An attacker submits a diagnostic request, for example a ping or traceroute, with a target parameter that contains a shell metacharacter followed by an arbitrary command. The command executes in the context of the Looking Glass service, providing a foothold on the host and potentially on managed routers reached via SSH.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-8hgf-p844-425m for maintainer-provided technical detail.
Detection Methods for CVE-2026-53611
Indicators of Compromise
- Unexpected child processes spawned by the Looking Glass Go binary, particularly sh, bash, curl, wget, or nc.
- Diagnostic request logs containing shell metacharacters such as ;, |, &, `, or $( in host or target fields.
- Outbound network connections from the Looking Glass host to unfamiliar external addresses immediately following API requests.
- SSH session logs on managed routers showing commands outside the expected ping, traceroute, or BGP command set.
Detection Strategies
- Inspect ConnectRPC and HTTP access logs for target parameters that do not match a strict IP or hostname format.
- Monitor process lineage on the Looking Glass host and alert on any non-SSH child processes forked from the service binary.
- Deploy behavioral endpoint detection to flag command-injection sequences originating from network-facing service processes.
Monitoring Recommendations
- Forward Looking Glass application logs and host process events to a centralized SIEM or data lake for correlation.
- Baseline expected outbound destinations from the Looking Glass host and alert on deviations.
- Track version metadata across deployments to identify instances still running builds prior to 1.3.5.
How to Mitigate CVE-2026-53611
Immediate Actions Required
- Upgrade Looking Glass to version 1.3.5 or later on every deployment.
- Restrict network exposure of the gRPC API and web UI to trusted management networks until patching is complete.
- Rotate SSH credentials used by Looking Glass to reach managed routers if compromise is suspected.
- Audit recent diagnostic request logs for parameters containing shell metacharacters.
Patch Information
The maintainer released the fix in the GitHub Release 1.3.5. The advisory and remediation details are documented in the GitHub Security Advisory GHSA-8hgf-p844-425m. Version 1.3.5 anchors the input validation regular expression so that only fully matching inputs are accepted.
Workarounds
- Place the Looking Glass service behind an authenticated reverse proxy or VPN to remove unauthenticated network exposure.
- Enforce upstream input validation, for example at an API gateway, that rejects any target parameter containing characters outside a strict IP or hostname character set.
- Run the Looking Glass binary as an unprivileged, non-root user with a restricted shell to limit post-exploitation impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.