Missing Authorization Vulnerability in UTMStack by UTMStack
CVE-2026-82041

6.5MEDIUM

Key Information:

Vendor

Utmstack

Status
Utmstack
Vendor
CVE Published:
2 October 2026

What is CVE-2026-82041?

UTMStack versions before 11.2.16 are susceptible to a missing authorization vulnerability located in the UTMIncidentCommandWebsocket.processCommand() function. This flaw arises from the lack of a proper role check or command allowlist, enabling any authenticated user to execute arbitrary operating system commands over gRPC on any connected agent. This results in potential command execution on monitored endpoints where agent processes typically operate with elevated privileges, such as root or SYSTEM.

Affected Version(s)

UTMStack 0 < 11.2.16

References

https://github.com/UTMStack/UTMStack/releases/tag/v11.2.16
release-notes
https://github.com/utmstack/UTMStack/commit/4e7a727c3b8d8...
patch
https://www.vulncheck.com/advisories/utmstack-missing-aut...
third-party-advisory

CVSS V4

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Nurudini (QwesiRED)
VulnCheck
.