CVE-2026-58652: Travelmate Privilege Escalation Flaw

CVE-2026-58652 Overview

CVE-2026-58652 is a privilege escalation vulnerability in luci-app-travelmate and the underlying travelmate package for OpenWrt. A LuCI/rpcd session holding the luci-app-travelmate write ACL receives config-wide UCI write access to the travelmate configuration. The LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, but this control exists only in the frontend. The backend travelmate service runs as root and reads the raw UCI script and script_args values, executing whatever path an attacker configures. This allows arbitrary command execution as root on the router.

Critical Impact
An authenticated user with delegated travelmate write permissions can set script to /bin/sh and inject attacker-controlled arguments, achieving root-level command execution when the captive-portal auto-login branch triggers.

Affected Products

luci-app-travelmate version 2.4.5-r3 (confirmed vulnerable)
travelmate package version 2.4.5-r3 (confirmed vulnerable)
travelmate version 2.4.6-1 (sink still present, no patched version known)

Discovery Timeline

2026-07-02 - CVE-2026-58652 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58652

Vulnerability Analysis

The flaw resides in the OpenWrt travelmate captive-portal auto-login workflow. The LuCI web interface presents an auto-login script picker constrained to files under /etc/travelmate/*.login. That constraint exists only in the browser-side dropdown and does not extend to the RPC layer or the backend daemon. When a session holds the luci-app-travelmate write ACL, rpcd grants unrestricted UCI write access to the entire travelmate configuration namespace. An attacker can therefore write arbitrary values to the script and script_args options through the RPC endpoint, bypassing the frontend allowlist.

The vulnerability is tracked as an OS command injection weakness [CWE-78]. Exploitation requires an existing low-privilege authenticated session with the delegated ACL, but produces full root code execution on the router.

Root Cause

The root cause is a combination of over-broad ACL delegation and missing backend input validation. The luci-app-travelmate write ACL confers config-wide UCI write rather than a narrowly scoped subset. The f_check() function in travelmate-functions.sh then consumes the raw script and script_args UCI values and passes them to a shell execution primitive without validating that script points inside /etc/travelmate/ or that script_args is free of shell metacharacters.

Attack Vector

An attacker first obtains a LuCI/rpcd session with the luci-app-travelmate write ACL. Using the uci RPC API, the attacker sets travelmate.global.script to /bin/sh and travelmate.global.script_args to a chain of shell arguments that execute attacker-controlled commands. When the router encounters a captive-portal auto-login attempt, the backend daemon reaches the auto-login branch of f_check() and executes the configured path as root. The result is arbitrary command execution with full privileges over the network device.

No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-58652

Indicators of Compromise

Unexpected values in /etc/config/travelmate where script points outside /etc/travelmate/ (for example /bin/sh, /bin/busybox, or a writable path).
Non-empty or suspicious script_args values containing shell metacharacters such as ;, |, &&, or $(.
LuCI or rpcd audit entries showing UCI set operations against travelmate.*.script from non-administrative users.
Unexpected root-owned processes spawned as children of the travelmate service, especially interactive shells or network utilities.

Detection Strategies

Monitor changes to /etc/config/travelmate using file integrity monitoring and alert on modifications to the script and script_args options.
Inspect rpcd and LuCI request logs for uci set calls targeting the travelmate namespace originating from delegated (non-root) accounts.
Alert when the travelmate daemon spawns child processes whose executable path is not under /etc/travelmate/.

Monitoring Recommendations

Ship OpenWrt logread output and rpcd access logs to a central log platform for retention and correlation.
Baseline the expected contents of /etc/config/travelmate and diff on each configuration reload.
Track ACL assignments in /usr/share/rpcd/acl.d/ and flag accounts granted luci-app-travelmate write access.

How to Mitigate CVE-2026-58652

Immediate Actions Required

Revoke the luci-app-travelmate write ACL from any account that does not require administrative control of the router.
Audit /etc/config/travelmate on all deployed devices and reset script and script_args to safe defaults under /etc/travelmate/.
Restrict LuCI and rpcd network exposure to trusted management VLANs or interfaces only.
Disable the travelmate package on devices that do not use captive-portal auto-login.

Patch Information

At publication no fixed release of luci-app-travelmate or travelmate addresses this issue; the vulnerable sink remains in travelmate 2.4.6-1. Track upstream progress through the OpenWrt LuCI Security Advisory GHSA-p35r-3323-6g7g and the referenced GitHub commits in openwrt/luci. Additional technical background is available in the VulnCheck advisory on travelmate arbitrary command execution.

Workarounds

Remove the travelmate package with opkg remove luci-app-travelmate travelmate on devices that do not require captive-portal automation.
Set the travelmate configuration files to root-only and remove the luci-app-travelmate ACL grant from /usr/share/rpcd/acl.d/.
Apply an outbound firewall rule that prevents the router from initiating shells or unexpected commands originating from the travelmate service context.

bash

# Configuration example: remove the delegated ACL and reset script values
rm /usr/share/rpcd/acl.d/luci-app-travelmate.json
uci set travelmate.global.script=''
uci set travelmate.global.script_args=''
uci commit travelmate
/etc/init.d/rpcd restart