CVE-2026-57999: luci-app-tailscale RCE Vulnerability

CVE-2026-57999 Overview

CVE-2026-57999 is a command injection vulnerability in the luci-app-tailscale-community package for OpenWrt LuCI. The flaw resides in the tailscale.do_login Remote Procedure Call (RPC) method. Authenticated users can execute arbitrary commands as root by supplying crafted loginserver or loginserver_authkey parameters. The application embeds these parameters inside a double-quoted shell command without proper sanitization. Shell substitution sequences such as $() execute in the outer shell before argument processing occurs. This flaw is tracked under CWE-78 (OS Command Injection).

Critical Impact
Authenticated attackers can achieve arbitrary command execution as root on OpenWrt devices running the vulnerable Tailscale LuCI application.

Affected Products

OpenWrt luci-app-tailscale-community package
LuCI web interface deployments with the Tailscale community app installed
OpenWrt router firmware bundling the affected LuCI module

Discovery Timeline

2026-06-29 - CVE-2026-57999 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57999

Vulnerability Analysis

The vulnerability affects the tailscale.do_login RPC method exposed by luci-app-tailscale-community. The method constructs a shell command as a double-quoted string that embeds two user-supplied parameters: loginserver and loginserver_authkey. Because the values are placed inside double quotes rather than being safely quoted or passed as separate argument vectors, the outer shell evaluates any command substitution before the target binary receives arguments.

Exploitation requires an authenticated session with access to the LuCI RPC endpoint. Successful abuse yields root-level command execution because LuCI RPC handlers run with elevated privileges on OpenWrt. Attackers can install persistence, pivot to internal networks, or exfiltrate configuration secrets such as WireGuard keys and Tailscale auth tokens.

The EPSS score is 1.179% (63.85 percentile), indicating moderate exploitation likelihood. No public exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Developers placed loginserver and loginserver_authkey inside a double-quoted shell string. Double quotes in POSIX shells preserve literal characters but still expand $(...), backticks, and ${...} sequences. The code did not validate or escape these parameters before invoking the shell.

Attack Vector

An authenticated attacker sends a crafted RPC request to the LuCI backend invoking the tailscale.do_login method. The attacker supplies a loginserver or loginserver_authkey value containing a shell substitution such as $(id > /tmp/pwn). The LuCI backend concatenates the value into a double-quoted command string and executes it via a shell interpreter running as root. The substitution executes prior to argument parsing, running attacker-controlled commands under the root account. Refer to the GitHub Security Advisory and VulnCheck Advisory for reproduction details.

Detection Methods for CVE-2026-57999

Indicators of Compromise

LuCI RPC requests to tailscale.do_login containing $(, backticks, or ${ sequences in loginserver or loginserver_authkey parameters.
Unexpected child processes spawned by the uhttpd or rpcd service running as root shortly after Tailscale login RPC calls.
New cron jobs, SSH authorized keys, or startup scripts appearing on OpenWrt devices without administrator action.
Outbound connections from OpenWrt devices to unfamiliar hosts following LuCI authenticated sessions.

Detection Strategies

Inspect LuCI RPC access logs for do_login invocations with metacharacters in parameter values.
Monitor /var/log/messages and logread output for shell errors or unusual command execution following Tailscale RPC traffic.
Deploy file integrity monitoring on /etc/, /root/, and /etc/init.d/ on OpenWrt devices to detect unauthorized modifications.

Monitoring Recommendations

Alert on any authenticated LuCI session that invokes tailscale.do_login with non-URL-safe characters in loginserver fields.
Track process ancestry where rpcd or uhttpd spawns unexpected binaries such as wget, curl, nc, or sh with non-standard arguments.
Forward OpenWrt syslog to a centralized platform and correlate LuCI authentication events with post-login command execution.

How to Mitigate CVE-2026-57999

Immediate Actions Required

Restrict LuCI web interface exposure to trusted management networks only. Block WAN-side access to the LuCI RPC endpoints.
Rotate all LuCI administrator credentials and enforce strong, unique passwords to reduce authenticated attacker footprint.
Audit installed OpenWrt packages and remove luci-app-tailscale-community on devices where Tailscale management via LuCI is not required.
Review authentication logs and process activity on affected devices for signs of prior exploitation.

Patch Information

Consult the GitHub Security Advisory GHSA-xwc5-mx58-rh35 for the fixed version of luci-app-tailscale-community. Upgrade to the patched release through the OpenWrt package manager once available. Fixed builds properly quote or exec-array the loginserver and loginserver_authkey parameters to prevent shell interpretation.

Workarounds

Uninstall the luci-app-tailscale-community package with opkg remove luci-app-tailscale-community until the patched version is deployed.
Configure Tailscale directly via CLI (tailscale up) and disable the LuCI-based login workflow.
Place OpenWrt management interfaces behind a VPN or bastion host and require multi-factor authentication for administrative sessions.

bash

# Configuration example: remove the vulnerable package and update the feed
opkg update
opkg remove luci-app-tailscale-community

# Restrict LuCI to LAN interface only in /etc/config/uhttpd
uci set uhttpd.main.listen_http='192.168.1.1:80'
uci set uhttpd.main.listen_https='192.168.1.1:443'
uci commit uhttpd
/etc/init.d/uhttpd restart