CVE-2026-89026: Issabel Framework JWT RCE Vulnerability

CVE-2026-89026 Overview

CVE-2026-89026 is a critical vulnerability in the Issabel Framework, the web framework supporting Issabel PBX software. Versions before commit b97dbaf contain a hard-coded HS256 JSON Web Token (JWT) signing key in the pbxapi/index.php file. The same key ships with every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers use forged tokens against the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary operating system (OS) commands as the Asterisk user. The Shadowserver Foundation first observed exploitation evidence on 2026-09-09. The weakness is tracked under CWE-321: Use of Hard-coded Cryptographic Key.

Critical Impact
Unauthenticated attackers can forge JWTs and execute arbitrary OS commands as the Asterisk user on any unpatched Issabel PBX instance reachable over the network.

Affected Products

Issabel Framework (web framework for Issabel PBX) prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd
Issabel PBX installations exposing the pbxapi endpoint
Any deployment relying on the default /etc/issabel.conf without a customized pbxapijwtsecret

Discovery Timeline

2026-09-09 - Shadowserver Foundation observes exploitation evidence in the wild
2026-09-15 - CVE-2026-89026 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89026

Vulnerability Analysis

The Issabel Framework authenticates API callers to the pbxapi service using HS256-signed JWTs. Prior to the fix, framework/html/pbxapi/index.php used a static signing key compiled into the source. Because HS256 is a symmetric algorithm, any actor with the key can mint tokens that the server treats as valid. An attacker retrieves the constant from public source code, then generates a bearer token with arbitrary claims. Once authenticated, the attacker invokes the Asterisk Manager Interface (AMI) originate action and specifies Application=System, which passes the Data field to a shell. The result is unauthenticated remote code execution as the Asterisk service account, giving the attacker full control over call routing, recordings, and the underlying host.

Root Cause

The root cause is a hard-coded cryptographic key [CWE-321] shared across every installation. The framework never rotated or derived a per-install secret, so signature verification provided no real authentication boundary. Any exposed pbxapi endpoint effectively accepted attacker-controlled tokens.

Attack Vector

Exploitation requires only network reachability to the pbxapi HTTP endpoint. No prior credentials, user interaction, or privilege is needed. The attacker crafts a JWT signed with the known key, submits it as a bearer token, and calls the manager originate endpoint with Application=System and a Data payload containing shell commands.

php

// Patch: framework/html/pbxapi/index.php
// Replaces the hard-coded JWT key with a per-install secret from /etc/issabel.conf
$f3->set('AUTOLOAD','models/; controllers/');
$f3->set('DEBUG',255);

if(!is_file("/etc/issabel.conf")) {
    throw new RuntimeException('/etc/issabel.conf not found');
}

$data    = parse_conf("/etc/issabel.conf");
$dbpass  = $data['mysqlrootpwd'];
$mgrpass = $data['amiadminpwd'];

if(empty($data['pbxapijwtsecret'])) {
    throw new RuntimeException('Missing pbxapijwtsecret in /etc/issabel.conf');
}

$jwtKey = base64_decode($data['pbxapijwtsecret'], true);
if($jwtKey === false || strlen($jwtKey) < 32) {
    throw new RuntimeException('pbxapijwtsecret must contain at least 32 random bytes encoded as Base64');
}

Source: Issabel Framework commit b97dbaf

Detection Methods for CVE-2026-89026

Indicators of Compromise

HTTP requests to /pbxapi/ paths bearing JWTs with unusual iss, sub, or long exp claims that do not match legitimate console usage.
Asterisk process spawning shell children such as sh, bash, wget, curl, nc, or python where none are expected.
New or modified cron entries, SSH authorized_keys, or web shells under paths writable by the Asterisk user.
Outbound connections from the PBX host to unfamiliar IPs shortly after pbxapi traffic.

Detection Strategies

Inspect Apache or Nginx access logs for POST requests to pbxapi endpoints containing Authorization: Bearer headers from untrusted networks.
Alert on AMI originate actions where Application=System is combined with commands the operator did not schedule.
Correlate PBX process telemetry with network events to surface Asterisk child processes performing external downloads or reverse shells.

Monitoring Recommendations

Enable verbose AMI logging and forward it to a central log store for retention and search.
Baseline outbound traffic from PBX servers and alert on deviations, especially to hosting or VPN ranges.
Monitor file integrity on /etc/issabel.conf, web roots, and Asterisk dial plan directories.

How to Mitigate CVE-2026-89026

Immediate Actions Required

Upgrade the Issabel Framework to a revision that includes commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
Generate a unique pbxapijwtsecret of at least 32 random bytes, Base64-encoded, and write it to /etc/issabel.conf.
Restrict network access to the pbxapi endpoint to trusted management networks using firewall rules or a reverse proxy allowlist.
Rotate AMI credentials, MySQL root password, and any secrets previously reachable from the PBX host in case of prior compromise.

Patch Information

The fix is available in the Issabel Framework repository at commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The patch removes the hard-coded key and requires operators to supply a per-install pbxapijwtsecret. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Block external access to /pbxapi/ at the web server or perimeter firewall until the patched framework is deployed.
Disable the pbxapi virtual host in Apache configuration if the API is not required for daily operations.
Remove or restrict the AMI account permissions so that System and Originate actions cannot be invoked from the API user.

bash

# Generate a strong per-install JWT secret and add it to /etc/issabel.conf
SECRET=$(openssl rand -base64 48)
echo "pbxapijwtsecret=${SECRET}" >> /etc/issabel.conf
chmod 600 /etc/issabel.conf
chown root:root /etc/issabel.conf

# Restrict pbxapi to a management CIDR (example using iptables)
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP