CVE-2026-82412: ntopng RCE Vulnerability

CVE-2026-82412 Overview

CVE-2026-82412 is an OS command injection vulnerability in ntopng, a web-based network traffic monitoring application. The flaw resides in the vulnerability-scan REST endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua. These endpoints accept the scan_ports parameter without an administrator check and pass it through validateSingleWord, which permits shell metacharacters. The value is then concatenated into an nmap command and executed via ntop.execCmd, ntop.execCmdAsync, or popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available on the host. The issue is fixed in version 6.7.260717.

Critical Impact

Authenticated low-privilege users can achieve arbitrary command execution as the ntopng process account, and the flaw is reachable via GET requests through a logged-in user's browser without valid ntopng credentials.

Affected Products

• ntopng versions prior to 6.7.260717
• Deployments where the nmap binary is available on the ntopng host
• Multi-user ntopng installations with non-administrator accounts enabled

Discovery Timeline

• 2026-09-21 - CVE-2026-82412 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82412

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. Two REST endpoints accept the scan_ports HTTP parameter and hand it directly to shell command construction. The validateSingleWord filter used by these endpoints permits characters such as ;, |, &, $, and backticks, which are meaningful to the underlying shell.

Inside scripts/lua/modules/vulnerability_scan/vs_utils.lua, the function nmap_scan_host concatenates scan_ports into an nmap command line. Execution then flows through ntop.execCmd, ntop.execCmdAsync, or popen, all of which invoke a shell. Any injected metacharacters therefore run as OS commands under the ntopng service account.

The endpoints accept GET requests, while ntopng's Cross-Site Request Forgery (CSRF) protection validates POST bodies. This asymmetry allows an unauthenticated external attacker to trigger command execution by luring a logged-in user to a crafted URL.

Root Cause

The root cause is a combination of missing authorization and insufficient input validation. The vulnerability-scan endpoints lack an isAdministrator() gate, so any authenticated user may reach the sink. The validateSingleWord validator does not enforce a numeric-only grammar for port lists, and command construction relies on string concatenation instead of an argument array.

Attack Vector

An authenticated non-admin user issues a GET request to the vulnerable REST endpoint with shell metacharacters embedded in scan_ports. Alternatively, an external attacker hosts a page that causes a logged-in victim's browser to issue the same GET request, bypassing CSRF validation that only covers POST bodies. The injected command runs as the ntopng process account with access to network monitoring data and local system resources.

// Patch: administrator gate added to scripts/lua/rest/v2/add/host/to_scan.lua
 local rest_utils = require "rest_utils"
 local vs_utils = require "vs_utils"
 
+if not isAdministrator() then
+    rest_utils.answer(rest_utils.consts.err.not_granted)
+    return
+end
+
 local host = _GET["host"]
 local scan_type = _GET["scan_type"]
 local scan_ports = _GET["scan_ports"]

Source: GitHub ntopng Commit 0d31562

// Patch: strict numeric validator for nmap ports in vs_utils.lua
+-- Validates the scan_ports parameter used for nmap.
+-- Allow plain numeric port lists/ranges only ("80,443" or "1-1000")
+local function is_valid_nmap_ports(ports)
+   if isEmptyString(ports) then return true end
+   if (#ports > 256) or not ports:match("^[%d,%-]+$") then return false end
+
+   for token in ports:gmatch("[^,]+") do
+      local from, to = token:match("^(%d+)%-(%d+)$")
+
+      if from and to then
+         from, to = tonumber(from), tonumber(to)
+         if not (from and to and from >= 1 and from <= to and to <= 65535) then
+            return false
+         end
+      else
+         local port = token:match("^%d+$") and tonumber(token)
+         if not (port and port >= 1 and port <= 65535) then
+            return false
+         end
+      end
+   end
+
+   return true
+end

Source: GitHub ntopng Commit 771b34a

Detection Methods for CVE-2026-82412

Indicators of Compromise

• HTTP GET requests to /lua/rest/v2/add/host/to_scan.lua or /lua/rest/v2/exec/host/schedule_vulnerability_scan.lua containing shell metacharacters (;, |, &, $(, backticks) in the scan_ports parameter.
• Child processes of the ntopng service that are not nmap, such as sh, bash, curl, wget, python, or reverse-shell binaries.
• Outbound network connections initiated by the ntopng process account to attacker-controlled infrastructure shortly after a vulnerability-scan request.

Detection Strategies

• Inspect ntopng web-server access logs for scan_ports values that do not match the strict grammar ^[0-9,\-]+$.
• Alert on process-lineage anomalies where ntopng spawns shells or interpreters instead of the expected nmap binary.
• Correlate authenticated non-admin session activity with vulnerability-scan endpoint invocations, which should normally be restricted to administrators.

Monitoring Recommendations

• Enable verbose HTTP request logging on ntopng and forward logs to a centralized analytics platform for retention and query.
• Monitor filesystem writes and cron modifications performed by the ntopng process account.
• Track outbound egress from ntopng hosts and baseline expected nmap scan destinations to surface deviations.

How to Mitigate CVE-2026-82412

Immediate Actions Required

• Upgrade ntopng to version 6.7.260717 or later, which adds administrator checks and strict numeric validation for scan_ports.
• Audit ntopng user accounts and remove or downgrade any non-administrator accounts that do not require access.
• Review web-server and audit logs for prior requests to the affected endpoints containing shell metacharacters.

Patch Information

The fix is delivered across multiple commits in the ntopng repository. Commit 0d31562 adds isAdministrator() gates to the affected REST endpoints. Commits 771b34a and 838ccd5 introduce the is_valid_nmap_ports validator that restricts scan_ports to plain numeric lists and ranges. See the GitHub Security Advisory GHSA-2c6p-4pfj-qv58 for the full advisory.

Workarounds

• Remove or restrict the nmap binary from the ntopng host if vulnerability scanning is not required, breaking the command execution path.
• Restrict access to the ntopng web interface using network-level controls such as firewalls, VPNs, or an authenticating reverse proxy.
• Front ntopng with a reverse proxy that blocks GET requests to /lua/rest/v2/add/host/to_scan.lua and /lua/rest/v2/exec/host/schedule_vulnerability_scan.lua for non-administrator sessions.

# Example reverse-proxy rule (nginx) to block risky scan_ports payloads
location ~ ^/lua/rest/v2/(add/host/to_scan|exec/host/schedule_vulnerability_scan)\.lua$ {
    if ($arg_scan_ports ~* "[^0-9,\-]") {
        return 403;
    }
    proxy_pass http://ntopng_backend;
}