CVE-2026-68489: Plesk Extensions RCE Vulnerability

CVE-2026-68489 Overview

CVE-2026-68489 is a static code injection vulnerability affecting the Plesk Ruby extension before version 1.6.6 and the Node.js Toolkit extension before version 2.5.0. Authenticated remote users can inject arbitrary code through custom environment variables, resulting in code execution as root on the underlying server. The flaw maps to CWE-96, Improper Neutralization of Directives in Statically Saved Code (Static Code Injection). Any tenant able to configure application environment variables through the Plesk control panel can leverage this weakness to escape their application boundary.

Critical Impact
Authenticated Plesk users can execute arbitrary code as root, resulting in full compromise of the hosting server and every site it hosts.

Affected Products

Plesk extension Ruby versions prior to 1.6.6
Plesk extension Node.js Toolkit versions prior to 2.5.0
Plesk servers hosting Ruby or Node.js applications configured with custom environment variables

Discovery Timeline

2026-09-14 - CVE-2026-68489 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-68489

Vulnerability Analysis

The Plesk Ruby and Node.js Toolkit extensions allow subscribers to define custom environment variables for their applications through the control panel interface. The extensions write these user-supplied values into configuration or wrapper files that are later interpreted by a privileged process. Because the values are stored without adequate neutralization, attacker-controlled content becomes part of executable code rather than data.

When the runtime consumes the generated artifact, the injected directives execute in the context of the process that manages application startup. On Plesk hosts, that process runs as root in order to switch users into individual subscription contexts. Exploitation therefore crosses both an application boundary and the tenant-to-host trust boundary.

Root Cause

The root cause is improper neutralization of directives in statically saved code, tracked as [CWE-96]. User-provided environment variable names or values flow into a generated script or configuration file that is subsequently interpreted. The extensions do not enforce a strict allow list on identifiers or escape metacharacters that carry syntactic meaning in the target file format.

Attack Vector

The attack requires an authenticated Plesk account with permission to manage a Ruby or Node.js application. The attacker navigates to the environment variable configuration for their subscription and submits a crafted name or value containing injection payloads. When Plesk regenerates the application wrapper or the runtime restarts, the injected code executes with root privileges. See the Plesk Support Article for vendor-provided technical details.

Detection Methods for CVE-2026-68489

Indicators of Compromise

Unexpected modifications to Plesk-managed Ruby or Node.js wrapper scripts and environment files under subscription directories.
New or modified files in system directories owned by root following environment variable changes made by non-root subscribers.
Outbound connections, reverse shells, or new privileged processes spawned from Plesk application management workers.
Audit log entries showing environment variable updates followed immediately by anomalous child processes.

Detection Strategies

Monitor Plesk action logs for Ruby and Node.js Toolkit environment variable modifications and correlate with subsequent process creation events.
Alert on root-owned processes spawned as descendants of Plesk extension helpers when the parent context should be a subscriber user.
Inspect generated wrapper scripts for shell metacharacters, backticks, $(...) sequences, or embedded interpreter directives in environment variable fields.

Monitoring Recommendations

Enable file integrity monitoring on Plesk extension directories and any generated application launch scripts.
Forward Plesk audit logs and Linux auditd process execution events to a centralized analytics platform for correlation.
Track privilege transitions from subscriber UIDs to UID 0 that originate from web-triggered workflows.

How to Mitigate CVE-2026-68489

Immediate Actions Required

Upgrade the Plesk Ruby extension to version 1.6.6 or later and the Node.js Toolkit extension to version 2.5.0 or later.
Audit existing subscriptions for suspicious environment variable values that contain shell metacharacters or interpreter directives.
Rotate credentials, API tokens, and keys stored on affected servers, since a successful exploit yields root access.
Review recently created system users, cron jobs, and SSH authorized keys for unauthorized entries.

Patch Information

Plesk has published fixed builds of both affected extensions. Administrators should apply extension updates through the Plesk Extensions Catalog and confirm installed versions meet or exceed Ruby 1.6.6 and Node.js Toolkit 2.5.0. Full remediation guidance is available in the Plesk Support Article.

Workarounds

Restrict access to the Ruby and Node.js Toolkit extensions to trusted administrators until patched builds are deployed.
Temporarily disable the ability for subscribers to define custom environment variables where the Plesk policy model allows it.
Remove or disable the affected extensions on servers that do not require Ruby or Node.js hosting.

bash

# Verify installed Plesk extension versions
plesk bin extension --list | grep -Ei 'ruby|nodejs'

# Upgrade the affected extensions from the catalog
plesk bin extension --upgrade ruby
plesk bin extension --upgrade nodejs