CVE-2026-66088 Details
Description
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
A vulnerability exists in openEQUELLA versions prior to 2026.1.0, allowing users to execute arbitrary operating system commands through the scripting engine's system.execute() and system.executeInBackground() functions. This execution occurs without any validation or allow-list of permitted executables, and commands are run with the privileges of the openEQUELLA service account. Users with the ability to create or edit scripts can exploit this vulnerability.
Users can upgrade to openEQUELLA version 2026.1.0 or later, where this vulnerability is fixed. After upgrading, the system.execute.allowedExecutables setting must be configured to specify permitted executables. Do not allow-list command shells or general-purpose interpreters, as this would reintroduce the vulnerability. If an immediate upgrade is not possible, restrict privileges that allow creating or editing scripts to trusted users and run the openEQUELLA service account with minimal operating system privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v | MON-CSIRT | AdvisoryExploitRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | MON-CSIRT |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | < 2026.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |