Remote Code Execution Vulnerability in Ajenti Server Management Panel
CVE-2026-79920

9.9CRITICAL

Key Information:

Vendor

Ajenti

Status
Ajenti
Vendor
CVE Published:
21 September 2026

What is CVE-2026-79920?

Ajenti, a modular server management panel for Linux and BSD, presents a vulnerability where authenticated users could exploit the /api/core/tasks/start endpoint to execute InstallPlugin, UnInstallPlugin, or UpgradeAll. These actions do not require plugin-management authorization, allowing a low-privileged user to manipulate or execute commands that interface with the Python package manager (pip) as root. This flaw introduces a significant security risk, where an attacker could install, remove, or upgrade software plugins without appropriate permissions, ultimately leading to potential system compromise. The vulnerability has been addressed in Ajenti version 2.2.16.

Affected Version(s)

ajenti < 2.2.16

References

https://github.com/ajenti/ajenti/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ajenti/ajenti/commit/3a8cbee32df4c5033...
x_refsource_MISC
https://github.com/ajenti/ajenti/commit/f07f02e0cdeeb3e52...
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.