CVE-2026-59682: OpenRGB Path Traversal Vulnerability

CVE-2026-59682 Overview

CVE-2026-59682 is an arbitrary file overwrite vulnerability in OpenRGB, the open-source RGB lighting control utility. The flaw exists in the handling of the SAVE_PROFILE network message and affects all versions of OpenRGB through 1.0rc3. A remote unauthenticated attacker who can reach the OpenRGB server socket can send a crafted SAVE_PROFILE message that writes attacker-controlled content to arbitrary filesystem paths. The weakness is classified as external control of file name or path [CWE-73].

Critical Impact
Remote unauthenticated attackers can overwrite arbitrary files accessible to the OpenRGB process, enabling integrity compromise and potential code execution through overwritten startup or configuration files.

Affected Products

OpenRGB through version 1.0rc3
OpenRGB SDK server component (network protocol handler)
Downstream distributions packaging OpenRGB, including SUSE (tracked in SUSE Bug #1274000)

Discovery Timeline

2026-08-26 - CVE-2026-59682 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-59682

Vulnerability Analysis

OpenRGB exposes a network protocol used by its SDK and remote clients to manage RGB devices and profile configurations. One protocol message, SAVE_PROFILE, instructs the server to persist a named profile to disk. The server accepts a profile name supplied by the client and uses it to construct the target file path without adequate validation.

Because the profile name is treated as external input controlling a filesystem path, an attacker can supply traversal sequences or absolute paths. The server then writes the profile payload to the resolved location, overwriting any file the OpenRGB process has permission to modify. The impact scope covers integrity and availability rather than confidentiality.

Root Cause

The root cause is improper neutralization of path components in the identifier passed via the SAVE_PROFILE message [CWE-73]. The server trusts the client-supplied profile name and does not constrain writes to a designated profile directory. The upstream fix in commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66 sanitizes profile names before file operations.

Attack Vector

Exploitation requires network access to the OpenRGB server port. No authentication or user interaction is required. An attacker sends a crafted SAVE_PROFILE packet containing a profile name with directory traversal or absolute path components, along with arbitrary payload bytes to be written. Overwriting shell startup files, authorized_keys, or application configuration files can lead to code execution in the context of the user running OpenRGB. See the GitLab OpenRGB fix commit for the vulnerable code path.

Detection Methods for CVE-2026-59682

Indicators of Compromise

Unexpected OpenRGB server listener exposed on non-loopback interfaces on the default TCP port 6742.
Modification timestamps on user dotfiles, ~/.ssh/authorized_keys, or systemd unit files coinciding with OpenRGB process activity.
Files outside the OpenRGB profile directory containing binary profile headers or RGB configuration structures.
Inbound connections to OpenRGB from untrusted hosts, especially over WAN or lateral network segments.

Detection Strategies

Inspect OpenRGB network traffic for SAVE_PROFILE messages containing ../, backslash sequences, or absolute path prefixes in the profile name field.
Alert on writes by the OpenRGB process to paths outside its configured profile directory using filesystem auditing tools such as auditd or Sysmon FileCreate events.
Correlate OpenRGB process file writes with subsequent execution of the modified files to identify follow-on activity.

Monitoring Recommendations

Log and review all inbound connections to TCP port 6742 and any custom OpenRGB SDK ports.
Monitor package inventories for OpenRGB versions at or below 1.0rc3 across managed endpoints.
Track integrity of user startup files and SSH key files on hosts where OpenRGB is installed.

How to Mitigate CVE-2026-59682

Immediate Actions Required

Upgrade OpenRGB to a version containing the fix from commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66, or apply the patch from a trusted distribution.
Bind the OpenRGB server to 127.0.0.1 only and disable the SDK server on systems that do not require remote control.
Block inbound traffic to TCP port 6742 at host and perimeter firewalls where OpenRGB remote access is not required.
Audit endpoints for OpenRGB installations at or below 1.0rc3 and prioritize remediation on multi-user or network-exposed hosts.

Patch Information

The upstream fix is available in the OpenRGB GitLab repository at commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66. Distribution tracking is available in the SUSE Bug Report #1274000. Users should update to a build that includes this commit or a distribution package that references the fix.

Workarounds

Run OpenRGB without the --server flag on systems that do not require the SDK network interface.
Restrict the OpenRGB process using AppArmor or SELinux profiles that limit write access to the configured profile directory only.
Use host firewall rules to permit connections to the OpenRGB port from trusted management hosts only.
Run OpenRGB under a dedicated low-privilege service account that has no write access to sensitive user or system files.

bash

# Restrict OpenRGB listener to loopback and firewall the SDK port
openrgb --server --server-host 127.0.0.1 --server-port 6742

# Linux iptables example to block remote access to the OpenRGB SDK port
iptables -A INPUT -p tcp --dport 6742 ! -s 127.0.0.1 -j DROP