CVE-2026-68766: hashcat Command Injection RCE Vulnerability

CVE-2026-68766 Overview

CVE-2026-68766 is an argument injection vulnerability in hashcat, the widely used password recovery tool. The flaw exists in how hashcat parses restore files, failing to restrict which command-line options can be reconstituted from the file contents. Attackers can craft a malicious restore file that injects output-redirecting flags such as --outfile and --potfile-path. When a victim resumes a cracking session, hashcat appends attacker-controlled content to arbitrary files on disk. Targeting shell startup files such as ~/.bashrc enables code execution under the victim's account. The issue is tracked as CWE-88: Argument Injection.

Critical Impact
A crafted restore file can write attacker-controlled data to any file writable by the hashcat user, resulting in local code execution when shell initialization files are overwritten.

Affected Products

hashcat versions through 7.1.2
Any downstream distribution packaging vulnerable hashcat releases
Systems where users open or resume untrusted .restore files

Discovery Timeline

2026-08-22 - CVE-2026-68766 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-68766

Vulnerability Analysis

hashcat supports session resumption through .restore files that persist the original command line and progress state. On resume, the tool reconstructs argv from the file and re-invokes its option parser. The parser accepts the full universe of command-line options rather than a restricted subset needed for resumption. An attacker who can place or trick a user into loading a crafted restore file controls those arguments. Injecting --outfile=/home/victim/.bashrc causes hashcat to append cracked-hash output, which is attacker-influenceable, to the shell startup file. The next interactive shell executes the appended payload.

Root Cause

The root cause is a lack of allowlisting in src/restore.c around lines 365–369, where hashcat blindly consumes command-line tokens from the restore file. See the vulnerable code reference in the hashcat v7.1.2 restore.c source. Options that influence output paths, module loading, or hook scripts were reachable through this path.

Attack Vector

Exploitation requires local delivery of a malicious restore file and user interaction to resume it. Typical vectors include phishing archives, shared cracking sessions, or compromised backups. No elevated privileges are required beyond those of the invoking user.

// Patch: include/types.h - restrict restore behavior
   REMOVE_TIMER             = 60,
   RESTORE_ENABLE           = true,
   RESTORE                  = false,
+  RESTORE_AUTO             = false,
+  RESTORE_POSITION         = false,
   RESTORE_TIMER            = 1,
   RP_GEN                   = 0,
   RP_GEN_FUNC_MAX          = 4,

Source: hashcat commit fcae69f

// Patch: src/hashcat.c - stop acting on restore-file command lines
   if (restore_ctx_init (hashcat_ctx, argc, argv) == -1) return -1;

+  // --restore has printed the command line the restore file holds and nothing else may run.
+  // Stopping here rather than further down is the point: user_options_preprocess has not run,
+  // so nothing has acted on a path that came out of the file and no output file or directory
+  // has been created.
+
+  if (hashcat_ctx->restore_ctx->print_only == true) return 0;
+
   /**
    * process user input
    */

Source: hashcat commit fcae69f

Detection Methods for CVE-2026-68766

Indicators of Compromise

Unexpected .restore files delivered from external sources or shared archives
Restore file contents containing --outfile, --outfile-path, --potfile-path, --debug-file, or --induction-dir flags
Modifications to shell startup files (~/.bashrc, ~/.zshrc, ~/.profile) immediately following a hashcat invocation
hashcat child processes spawning shells or writing outside the working directory

Detection Strategies

Inspect all .restore files with a scanner that parses the embedded command line and flags disallowed options.
Alert on hashcat process events where the effective --outfile or --potfile-path argument resolves to a path outside a designated cracking directory.
Correlate hashcat execution telemetry with subsequent writes to user shell initialization files.

Monitoring Recommendations

Enable file integrity monitoring on ~/.bashrc, ~/.zshrc, ~/.profile, and /etc/profile.d/.
Log full command lines for hashcat invocations through auditd or equivalent process auditing.
Baseline expected hashcat output directories and alert on deviations.

How to Mitigate CVE-2026-68766

Immediate Actions Required

Upgrade hashcat to a release that includes commit fcae69f2438ff8eae0dc8e206b78067a1e465ed4 or later.
Audit and delete .restore files received from untrusted sources or shared multi-user hosts.
Review shell startup files on systems where hashcat has been used with restore files.

Patch Information

The fix is delivered in hashcat commit fcae69f, which prevents hashcat from acting on command lines pulled from restore files. Additional context is available in the VulnCheck advisory and hashcat issue #4738.

Workarounds

Do not resume .restore files that originated outside the local user's own sessions.
Run hashcat inside a dedicated unprivileged account with no writable shell startup files.
Execute hashcat within a container or sandbox with a restricted, read-only home directory.

bash

# Verify installed hashcat version and update
hashcat --version

# Build from patched source
git clone https://github.com/hashcat/hashcat.git
cd hashcat
git checkout fcae69f2438ff8eae0dc8e206b78067a1e465ed4
make && sudo make install

# Run hashcat in a restricted sandbox user
sudo useradd -m -s /bin/bash cracker
sudo -u cracker hashcat -m 0 hashes.txt wordlist.txt