CVE-2026-59260 Overview
CVE-2026-59260 affects OpenWrt's luci-app-samba4 package, which exposes a privilege escalation flaw through an overly permissive read Access Control List (ACL). The ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to invoke the Samba daemon with attacker-controlled command-line arguments. Because smbd runs as root, attackers can supply arbitrary Samba global options such as message command to trigger command execution when SMB protocol messages are processed. The issue is tracked under CWE-269: Improper Privilege Management.
Critical Impact
Authenticated LuCI users with limited delegated privileges can achieve root-level command execution on affected OpenWrt routers by abusing the exposed smbd binary through Samba global options.
Affected Products
- OpenWrt luci-app-samba4 package
- OpenWrt LuCI web interface installations bundling the Samba4 module
- Router deployments exposing LuCI to delegated (non-root) accounts
Discovery Timeline
- 2026-07-12 - CVE-2026-59260 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-59260
Vulnerability Analysis
The OpenWrt LuCI framework enforces role-based access through ACL definitions. In luci-app-samba4, the read ACL incorrectly grants file.exec permission on /usr/sbin/smbd. That permission lets a delegated authenticated user spawn the Samba daemon binary directly through LuCI's RPC surface. Because LuCI executes helper binaries as root, the invoked smbd process inherits root privileges.
Attackers control the argument vector passed to smbd. Samba accepts global configuration overrides on the command line via the --option flag. Supplying --option="message command=<cmd>" registers an arbitrary shell command that Samba executes when it processes incoming SMB messages. This turns a read-only ACL entry into a full remote code execution primitive.
Root Cause
The root cause is a mismatch between the ACL's intent and its effect. Read permission on Samba configuration should not include file.exec on the daemon binary. Assigning execute rights to a root-owned service binary in a read ACL violates least-privilege principles described in CWE-269.
Attack Vector
An authenticated user with the delegated Samba read role authenticates to LuCI, then issues an RPC that invokes /usr/sbin/smbd with crafted arguments. The arguments inject a message command global option pointing to an attacker payload. Once any SMB message triggers the command hook, the payload executes as root. See the OpenWrt LuCI security advisory and the VulnCheck advisory for technical details.
Detection Methods for CVE-2026-59260
Indicators of Compromise
- Unexpected smbd process invocations originating from the LuCI rpcd process tree rather than the system init or service manager.
- smbd command lines containing --option flags referencing message command, preexec, postexec, root preexec, or add share command.
- New or modified files under /tmp, /etc, or /www created by processes with a root UID shortly after LuCI authentication events.
- Outbound network connections initiated by child processes of smbd to non-SMB destinations.
Detection Strategies
- Alert on any execution of /usr/sbin/smbd whose parent is not the OpenWrt service supervisor (procd).
- Inspect LuCI access logs for authenticated sessions invoking Samba-related RPC endpoints followed by shell activity.
- Monitor for smbd invocations that include command-line arguments referencing arbitrary shell binaries such as /bin/sh, busybox, or wget.
Monitoring Recommendations
- Enable verbose rpcd and LuCI authentication logging and forward logs to a central collector for correlation.
- Track process-execution telemetry on OpenWrt devices, including parent-child relationships for smbd.
- Review Samba runtime configuration and command-line arguments after each service start to detect injected global options.
How to Mitigate CVE-2026-59260
Immediate Actions Required
- Remove or disable the luci-app-samba4 package on OpenWrt devices where delegated user accounts exist.
- Restrict LuCI access to trusted administrators only until a patched package is installed.
- Audit existing LuCI users and revoke delegated roles that include Samba read permissions.
- Rotate credentials for any account that had access to the vulnerable ACL entry.
Patch Information
Refer to the OpenWrt LuCI GitHub Security Advisory GHSA-vx64-mmp7-h36c for the fixed luci-app-samba4 release and upgrade instructions. Update via opkg update && opkg upgrade luci-app-samba4 once the corrected package is available in your OpenWrt feed.
Workarounds
- Remove file.exec permission on /usr/sbin/smbd from the luci-app-samba4 read ACL JSON definition under /usr/share/rpcd/acl.d/.
- Bind the LuCI web interface to the LAN only and place administrative access behind a VPN.
- Disable the Samba service entirely on routers that do not require SMB file sharing.
# Configuration example: remove smbd exec from the samba4 read ACL
# Edit /usr/share/rpcd/acl.d/luci-app-samba4.json and delete the
# "/usr/sbin/smbd" entry from the "file": { "exec": [ ... ] } block,
# then restart rpcd:
/etc/init.d/rpcd restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
