CVE-2026-88837: BusyBox httpd Auth Bypass Vulnerability

CVE-2026-88837 Overview

CVE-2026-88837 is an authentication bypass vulnerability in BusyBox httpd. The daemon mishandles yescrypt password hashes prefixed with $y$ during HTTP Basic Authentication. Instead of validating a supplied credential against the stored hash, httpd treats the hash as plaintext and inverts the comparison logic. This weakness is classified under [CWE-305: Authentication Bypass by Primary Weakness].

Attackers who can reach an affected httpd instance over the network may authenticate without knowing the account password. The flaw affects deployments that store credentials using the modern yescrypt algorithm, which is the default on several Linux distributions.

Critical Impact
Remote attackers can bypass Basic Authentication on BusyBox httpd when yescrypt password hashes are used, exposing protected web resources to unauthorized access.

Affected Products

BusyBox httpd builds that link the yescrypt-aware crypt() implementation
Embedded Linux distributions and appliances shipping BusyBox with Basic Authentication enabled
Container images derived from BusyBox with password-protected web endpoints

Discovery Timeline

2026-09-23 - CVE-2026-88837 published to the National Vulnerability Database
2026-09-23 - Last updated in the NVD database

Technical Details for CVE-2026-88837

Vulnerability Analysis

BusyBox httpd supports HTTP Basic Authentication using credentials configured in its httpd.conf file. Passwords may be stored as plaintext or as crypt()-style hashes identified by a leading $ prefix and algorithm identifier. The authentication routine inspects the stored value to decide whether to hash the client-supplied password before comparing it.

The routine recognizes older hash prefixes such as $1$ (MD5), $5$ (SHA-256), and $6$ (SHA-512). It does not recognize the yescrypt prefix $y$. When the stored credential begins with $y$, httpd falls through to a code path that compares the client input directly against the stored hash string. The comparison result is then inverted before granting access.

The inverted check means that any supplied password other than the literal hash string is accepted. Attackers do not need to know or crack the stored hash. They only need to send an arbitrary password in the Authorization: Basic header to satisfy the check.

Root Cause

The root cause is missing handling for the yescrypt hash identifier inside the Basic Authentication comparison logic. The code lacks a branch that invokes crypt() for $y$ hashes and reuses a code path intended for a different case. The inverted return value on that path converts a failed literal match into a successful authentication.

Attack Vector

Exploitation requires network access to the httpd listener and knowledge that yescrypt hashes are configured for at least one account. The attacker issues a standard HTTP request with a Basic credential containing the target username and any password value that differs from the stored hash string. httpd returns the protected resource.

See the Red Hat CVE-2026-88837 advisory and Red Hat Bug 2531351 for vendor analysis.

Detection Methods for CVE-2026-88837

Indicators of Compromise

Successful HTTP 200 responses to Basic-authenticated requests from unexpected source addresses against BusyBox httpd endpoints
httpd.conf entries containing password hashes with the $y$ prefix on hosts running vulnerable BusyBox builds
Access log entries showing repeated authentication attempts with varying password lengths from a single client

Detection Strategies

Audit BusyBox binaries in production and container images for the affected version and inspect authentication configuration for yescrypt hashes
Correlate web access logs with authentication events to identify sessions established without prior credential enumeration or lockout
Deploy network signatures that flag Basic Authentication success on embedded management interfaces exposed outside trusted segments

Monitoring Recommendations

Forward httpd access and error logs to a central analytics platform and alert on authenticated access to administrative paths from new source addresses
Track process and file integrity for /etc/httpd.conf and equivalent configuration files on embedded devices
Monitor egress from devices running BusyBox httpd for signs of post-authentication configuration changes or firmware retrieval

How to Mitigate CVE-2026-88837

Immediate Actions Required

Restrict network exposure of BusyBox httpd to trusted management networks until a fixed build is deployed
Replace any $y$ yescrypt hashes in httpd.conf with a supported hash format such as $6$ SHA-512 as a temporary control
Disable Basic Authentication on non-essential endpoints and require access through an authenticated reverse proxy

Patch Information

Refer to the Red Hat CVE-2026-88837 advisory for distribution-specific package updates. Rebuild container images and embedded firmware to include the patched BusyBox release once available. Vendor status for other distributions was not published at the time of NVD entry.

Workarounds

Configure httpd.conf to use SHA-512 ($6$) hashes instead of yescrypt for accounts that authenticate through BusyBox httpd
Terminate TLS and authentication at an upstream proxy such as nginx and forward only authenticated requests to BusyBox httpd
Apply firewall rules that restrict inbound access to the httpd port to specific administrative source addresses

bash

# Configuration example: replace yescrypt hash with SHA-512 in httpd.conf
# Generate a SHA-512 hash for the account password
mkpasswd -m sha-512 'NEW_STRONG_PASSWORD'

# Update /etc/httpd.conf entry (format: /path:user:hash)
# Replace the $y$... entry with the $6$... hash produced above
/protected:admin:$6$rounds=656000$SALT$HASH

# Restart the BusyBox httpd service
killall -HUP httpd