Authorization Bypass in Asterisk Telephony Toolkit
CVE-2026-57200
What is CVE-2026-57200?
A vulnerability exists in Asterisk, an open source telephony toolkit, wherein an authenticated attacker holding read-only access to the Asterisk REST Interface (ARI) can exploit the system by performing unauthorized write operations via REST-over-WebSocket. This issue allows for arbitrary module path loading and conditional execution of remote code. It is important to note that the Asterisk HTTP web server must be enabled and reachable for the attack to take place, with the default configuration denying access on external interfaces. The vulnerability has been addressed in various updates, including Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3.
Affected Version(s)
asterisk < 20.20.1 < 20.20.1
asterisk >= 21.0.0-pre1, < 21.12.3 < 21.0.0-pre1, 21.12.3
asterisk >= 22.0.0-pre1, < 22.10.1 < 22.0.0-pre1, 22.10.1