Command Injection Vulnerability in OpenWrt's HTTPS DNS Proxy Add-On
CVE-2026-46368

8.7HIGH

Key Information:

Vendor: Mossdef-org
Status: Luci-app-https-dns-proxy
Vendor: CVE Published:; 26 May 2026

🔔 Create Mossdef-org Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-46368?

The luci-app-https-dns-proxy, an optional add-on for OpenWrt, is susceptible to a command injection flaw within its setInitAction function. This vulnerability allows an authenticated user with specific permissions to inject shell metacharacters via the 'name' parameter during an ubus RPC call, potentially leading to arbitrary command execution with root privileges on the affected device. It is important to note that only installations opting for this add-on are vulnerable, while core OpenWrt remains unaffected.

Affected Version(s)

luci-app-https-dns-proxy 0 <= 2025.12.29-5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-46368 - Proof of Concept