Vulnerability in FOG Storage Node User Management Allows Unauthorized Command Execution

CVE-2026-116778

What is CVE-2026-116778?

The FOG Project's cloning and imaging system has a vulnerability that allows an authenticated user with limited privileges to alter critical Storage Node configurations. An API-enabled user, possessing both a specific user API token and the global FOG API token, can exploit a flaw in the role validation process to modify sensitive fields. This misconfiguration allows them to execute commands with root permissions due to the improper handling of API calls, especially when paired with storage replication functionalities. Organizations using affected versions should urgently upgrade to the patched releases, 1.5.10.2253 or 1.6.0-RC-1, to mitigate this security risk.

References