CVE-2026-58000: luci-proto-openvpn RCE Vulnerability

CVE-2026-58000 Overview

CVE-2026-58000 is a command injection vulnerability [CWE-78] in luci-proto-openvpn through version 0.11.1, part of the OpenWrt LuCI web interface. The flaw resides in the generateKey ubus method, where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root through the popen function. The issue is fixed in commit e4ff45e.

Critical Impact
Authenticated LuCI users with OpenVPN configuration privileges can execute arbitrary commands as root on the router, leading to full device compromise.

Affected Products

OpenWrt LuCI luci-proto-openvpn package versions through 0.11.1
OpenWrt deployments using LuCI with the OpenVPN protocol module installed
Devices exposing the LuCI web interface to authenticated users with OpenVPN configuration rights

Discovery Timeline

2026-06-29 - CVE-2026-58000 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-58000

Vulnerability Analysis

The vulnerability exists in the luci.openvpn.uc ucode script that implements the generateKey ubus method. The method constructs an openvpn shell command string by interpolating request arguments into a template literal. Most arguments pass through the shellquote helper, but the cl_meta argument is inserted raw. When the command runs through popen, an attacker-controlled string can terminate the intended argument list and append arbitrary shell syntax.

Because the OpenVPN key generation utility executes as root on OpenWrt, injected commands inherit root privileges. This provides a direct path from an authenticated web-interface role to full device takeover.

Root Cause

The defect is a classic OS command injection [CWE-78] caused by inconsistent input sanitization. The developer applied shellquote to the server_key and path parameters but omitted the same treatment for cl_meta. Shell metacharacters such as ;, |, &&, and backticks in the cl_meta value are interpreted by the shell rather than passed literally to openvpn.

Attack Vector

An attacker authenticates to LuCI with an account that can configure the OpenVPN protocol, then invokes the generateKey ubus method with a crafted cl_meta value containing shell metacharacters. The resulting shell command runs the attacker's payload as root before or after the legitimate openvpn invocation.

text

// Patch diff from protocols/luci-proto-openvpn/root/usr/share/rpcd/ucode/luci.openvpn.uc
// denote which server key this client key is derived from in the name
path = `${mkpath}/${ifname}_${kt}_${ts}-${req.args?.server_key}`;
- cmd = `${openvpn} --tls-crypt-v2 ${shellquote(server_key)} --genkey tls-crypt-v2-client ${shellquote(path)} ${req.args?.cl_meta} 2>/dev/null`;
+ cmd = `${openvpn} --tls-crypt-v2 ${shellquote(server_key)} --genkey tls-crypt-v2-client ${shellquote(path)} ${shellquote(req.args?.cl_meta)} 2>/dev/null`;
} else {
    // basic genkey
    cmd = `${openvpn} --genkey ${kt} ${shellquote(path)} 2>/dev/null`;

Source: GitHub commit e4ff45e. The patch wraps req.args?.cl_meta in shellquote, aligning it with the other interpolated parameters.

Detection Methods for CVE-2026-58000

Indicators of Compromise

Unexpected child processes spawned by the rpcd or uhttpd process trees on OpenWrt devices, particularly shells or network utilities such as sh, wget, curl, or nc.
Modifications to /etc/passwd, /etc/shadow, /etc/dropbear/authorized_keys, or /etc/rc.local that do not correspond to administrator activity.
New or altered files under /tmp or /etc/openvpn created around the time of generateKey ubus calls.

Detection Strategies

Inspect rpcd logs and LuCI access logs for generateKey invocations containing shell metacharacters such as ;, |, &, $(, or backticks in the cl_meta field.
Monitor authenticated LuCI sessions that transition from configuration actions into anomalous process execution on the router.
Compare the deployed luci.openvpn.uc file hash against the patched version at commit e4ff45e to identify unpatched devices.

Monitoring Recommendations

Forward OpenWrt system and rpcd logs to a centralized log store and alert on shell metacharacters appearing in ubus argument values.
Track process ancestry on managed OpenWrt fleets and alert when the openvpn binary launches unexpected child commands.
Review LuCI user accounts and role assignments so that OpenVPN configuration rights are limited to trusted administrators.

How to Mitigate CVE-2026-58000

Immediate Actions Required

Upgrade luci-proto-openvpn to a build that includes commit e4ff45e or later.
Restrict LuCI web interface exposure to trusted management networks and require VPN access for administration.
Audit LuCI accounts and revoke OpenVPN configuration privileges from any account that does not require them.

Patch Information

The fix is available in the OpenWrt LuCI repository as commit e4ff45e, which applies shellquote to the cl_meta argument before interpolating it into the openvpn command string. Refer to the GitHub Security Advisory GHSA-pm9w-522m-8rrh and the VulnCheck advisory for details.

Workarounds

Remove the luci-proto-openvpn package on devices that do not require OpenVPN client protocol configuration through LuCI.
Block access to the LuCI web interface from untrusted networks using firewall rules on the WAN and guest interfaces.
Enforce strong, unique credentials and multi-factor gated access (for example, jump host or VPN) before reaching the LuCI login page.

bash

# Update the affected package on OpenWrt after patched feeds are available
opkg update
opkg upgrade luci-proto-openvpn

# Optional: remove the package if OpenVPN protocol configuration is not required
opkg remove luci-proto-openvpn

# Restrict LuCI (uhttpd) to the LAN interface only
uci set uhttpd.main.listen_http='192.168.1.1:80'
uci set uhttpd.main.listen_https='192.168.1.1:443'
uci commit uhttpd
/etc/init.d/uhttpd restart