CVE-2026-55159 Overview
CVE-2026-55159 is a CRLF (carriage-return line-feed) injection vulnerability in luci-app-adblock-fast, a LuCI WebUI for the fast, lightweight DNS-based ad-blocker for OpenWrt. The luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument before serializing the value into /etc/crontabs/root. An authenticated user holding the luci-app-adblock-fast write ACL can inject a second physical cron line, resulting in persistent command execution as UID 0 when cron runs. The flaw is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences) and is fixed in version 1.2.4-2.
Critical Impact
Any delegated LuCI user with the component write ACL can escalate to root code execution on the OpenWrt device via a crafted cron entry.
Affected Products
- OpenWrt luci-app-adblock-fast versions prior to 1.2.4-2
- OpenWrt LuCI installations exposing the luci.adblock-fast RPC namespace
- OpenWrt devices with delegated LuCI users granted the luci-app-adblock-fast write ACL
Discovery Timeline
- 2026-09-21 - CVE-2026-55159 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-55159
Vulnerability Analysis
The vulnerable code path lives in applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, which exposes the setCronEntry RPC method. The handler accepts a caller-supplied entry string and writes it directly into /etc/crontabs/root without stripping \r or \n characters. Because cron treats each newline as a separate scheduled job, an attacker can embed a full second cron line inside a single logical entry.
Exploitation requires authentication and the luci-app-adblock-fast write ACL, so the attack surface is limited to delegated administrative users rather than anonymous callers. Once the injected entry is written, the appended job executes as UID 0 on the next cron tick, giving the attacker persistent root command execution on the OpenWrt device.
Root Cause
The root cause is missing neutralization of CRLF sequences before serialization into a line-oriented configuration file. luci.adblock-fast.setCronEntry treats the RPC argument as opaque text and relies on the assumption that a single call produces a single line, which does not hold when the input contains embedded newlines.
Attack Vector
The attacker authenticates to LuCI as a delegated user with the required ACL, invokes luci.adblock-fast.setCronEntry over the RPC endpoint, and supplies an entry value containing a \n followed by a second cron schedule and command. When cron next reads /etc/crontabs/root, the injected schedule fires and runs the attacker's command as root.
// Patch: luci-app-adblock-fast Makefile version bump to 1.2.4-2
PKG_NAME:=luci-app-adblock-fast
PKG_LICENSE:=AGPL-3.0-or-later
PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
-PKG_VERSION:=1.2.2
-PKG_RELEASE:=18
+PKG_VERSION:=1.2.4
+PKG_RELEASE:=2
LUCI_TITLE:=AdBlock-Fast Web UI
LUCI_URL:=https://github.com/mossdef-org/luci-app-adblock-fast/
// Source: https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-55159
Indicators of Compromise
- Unexpected additional lines in /etc/crontabs/root that were not authored by an administrator, especially lines invoking shells, wget, curl, or writing to /tmp.
- LuCI/rpcd log entries showing calls to luci.adblock-fast.setCronEntry with unusually long entry arguments or non-printable characters.
- New root-owned processes spawned from cron on a schedule that does not match documented ad-blocker maintenance jobs.
Detection Strategies
- Diff /etc/crontabs/root against a known-good baseline and alert on any change that increases the line count outside of a package upgrade window.
- Inspect rpcd request bodies for the luci.adblock-fast namespace and flag entry values containing raw \r or \n bytes.
- Correlate LuCI authentication events for delegated users with subsequent cron file modifications on the same device.
Monitoring Recommendations
- Ship OpenWrt logread output and /etc/crontabs/root file-integrity events to a central log store for retention and search.
- Track invocations of RPC methods that mutate persistent files (setCronEntry, config writes) and alert on off-hours usage.
- Monitor outbound network activity from OpenWrt devices for beaconing patterns consistent with cron-driven implants.
How to Mitigate CVE-2026-55159
Immediate Actions Required
- Upgrade luci-app-adblock-fast to 1.2.4-2 or later on every OpenWrt device where the package is installed.
- Audit /etc/crontabs/root for unauthorized entries and remove any lines not tied to a legitimate scheduled task.
- Review LuCI ACL assignments and revoke the luci-app-adblock-fast write ACL from any user that does not require it.
Patch Information
The fix ships in luci-app-adblock-fast1.2.4-2, delivered through OpenWrt LuCI commits 9ccd99b and f67461f, and merged via LuCI Pull Request #8705. Full advisory details are in GHSA-ggpf-xrph-wg5v.
Workarounds
- Restrict LuCI access to trusted administrators and remove the luci-app-adblock-fast write ACL from delegated user roles until patching completes.
- Temporarily uninstall luci-app-adblock-fast on devices where the ad-blocker WebUI is not required.
- Place LuCI behind a network ACL or VPN so that only management hosts can reach the RPC endpoint.
# Upgrade luci-app-adblock-fast on OpenWrt to the fixed release
opkg update
opkg install luci-app-adblock-fast
opkg list-installed | grep luci-app-adblock-fast # expect 1.2.4-2 or later
# Audit root crontab for injected entries
cat /etc/crontabs/root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
