CVE-2026-55159: OpenWrt luci-app-adblock-fast RCE Vulnerability

CVE-2026-55159 Overview

CVE-2026-55159 is a CRLF (carriage-return line-feed) injection vulnerability in luci-app-adblock-fast, a LuCI WebUI for the fast, lightweight DNS-based ad-blocker for OpenWrt. The luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument before serializing the value into /etc/crontabs/root. An authenticated user holding the luci-app-adblock-fast write ACL can inject a second physical cron line, resulting in persistent command execution as UID 0 when cron runs. The flaw is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences) and is fixed in version 1.2.4-2.

Critical Impact
Any delegated LuCI user with the component write ACL can escalate to root code execution on the OpenWrt device via a crafted cron entry.

Affected Products

OpenWrt luci-app-adblock-fast versions prior to 1.2.4-2
OpenWrt LuCI installations exposing the luci.adblock-fast RPC namespace
OpenWrt devices with delegated LuCI users granted the luci-app-adblock-fast write ACL

Discovery Timeline

2026-09-21 - CVE-2026-55159 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55159

Vulnerability Analysis

The vulnerable code path lives in applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, which exposes the setCronEntry RPC method. The handler accepts a caller-supplied entry string and writes it directly into /etc/crontabs/root without stripping \r or \n characters. Because cron treats each newline as a separate scheduled job, an attacker can embed a full second cron line inside a single logical entry.

Exploitation requires authentication and the luci-app-adblock-fast write ACL, so the attack surface is limited to delegated administrative users rather than anonymous callers. Once the injected entry is written, the appended job executes as UID 0 on the next cron tick, giving the attacker persistent root command execution on the OpenWrt device.

Root Cause

The root cause is missing neutralization of CRLF sequences before serialization into a line-oriented configuration file. luci.adblock-fast.setCronEntry treats the RPC argument as opaque text and relies on the assumption that a single call produces a single line, which does not hold when the input contains embedded newlines.

Attack Vector

The attacker authenticates to LuCI as a delegated user with the required ACL, invokes luci.adblock-fast.setCronEntry over the RPC endpoint, and supplies an entry value containing a \n followed by a second cron schedule and command. When cron next reads /etc/crontabs/root, the injected schedule fires and runs the attacker's command as root.

text

// Patch: luci-app-adblock-fast Makefile version bump to 1.2.4-2
 PKG_NAME:=luci-app-adblock-fast
 PKG_LICENSE:=AGPL-3.0-or-later
 PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
-PKG_VERSION:=1.2.2
-PKG_RELEASE:=18
+PKG_VERSION:=1.2.4
+PKG_RELEASE:=2

 LUCI_TITLE:=AdBlock-Fast Web UI
 LUCI_URL:=https://github.com/mossdef-org/luci-app-adblock-fast/
// Source: https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e

Detection Methods for CVE-2026-55159

Indicators of Compromise

Unexpected additional lines in /etc/crontabs/root that were not authored by an administrator, especially lines invoking shells, wget, curl, or writing to /tmp.
LuCI/rpcd log entries showing calls to luci.adblock-fast.setCronEntry with unusually long entry arguments or non-printable characters.
New root-owned processes spawned from cron on a schedule that does not match documented ad-blocker maintenance jobs.

Detection Strategies

Diff /etc/crontabs/root against a known-good baseline and alert on any change that increases the line count outside of a package upgrade window.
Inspect rpcd request bodies for the luci.adblock-fast namespace and flag entry values containing raw \r or \n bytes.
Correlate LuCI authentication events for delegated users with subsequent cron file modifications on the same device.

Monitoring Recommendations

Ship OpenWrt logread output and /etc/crontabs/root file-integrity events to a central log store for retention and search.
Track invocations of RPC methods that mutate persistent files (setCronEntry, config writes) and alert on off-hours usage.
Monitor outbound network activity from OpenWrt devices for beaconing patterns consistent with cron-driven implants.

How to Mitigate CVE-2026-55159

Immediate Actions Required

Upgrade luci-app-adblock-fast to 1.2.4-2 or later on every OpenWrt device where the package is installed.
Audit /etc/crontabs/root for unauthorized entries and remove any lines not tied to a legitimate scheduled task.
Review LuCI ACL assignments and revoke the luci-app-adblock-fast write ACL from any user that does not require it.

Patch Information

The fix ships in luci-app-adblock-fast1.2.4-2, delivered through OpenWrt LuCI commits 9ccd99b and f67461f, and merged via LuCI Pull Request #8705. Full advisory details are in GHSA-ggpf-xrph-wg5v.

Workarounds

Restrict LuCI access to trusted administrators and remove the luci-app-adblock-fast write ACL from delegated user roles until patching completes.
Temporarily uninstall luci-app-adblock-fast on devices where the ad-blocker WebUI is not required.
Place LuCI behind a network ACL or VPN so that only management hosts can reach the RPC endpoint.

bash

# Upgrade luci-app-adblock-fast on OpenWrt to the fixed release
opkg update
opkg install luci-app-adblock-fast
opkg list-installed | grep luci-app-adblock-fast   # expect 1.2.4-2 or later

# Audit root crontab for injected entries
cat /etc/crontabs/root