CVE-2026-69096 Details

A command injection vulnerability has been identified in the OpenWrt LuCI application 'luci-app-dockerman', specifically in the master and openwrt-25.12 snapshots that include the 'ucode docker_rpc.uc' backend after the JavaScript to ucode conversion. This vulnerability arises from the application's read access control list (ACL), which permits extensive access to 'docker.*' and 'docker.container.*' methods. The 'docker.container.ttyd_start' method, which is exposed despite its mutating nature, can be exploited by authenticated users with the 'luci-app-dockerman' read ACL. The 'run_ttyd' function constructs a shell command using request-controlled 'id', 'cmd', and 'uid' fields, and executes it via the 'system()' function in the root context of 'rpcd', without proper sanitization. As a result, an attacker can inject shell metacharacters to execute arbitrary commands as root by sending an HTTP POST request to '/ubus'.

Remove 'docker.*: [ "*" ]' from the read ACL in 'luci-app-dockerman.json'. Move 'ttyd_start' and similar mutating functions to require write or admin permissions. Implement stricter validation for the 'id', 'cmd', 'uid', and 'port' fields to ensure they do not contain harmful characters. Additionally, add tests to review ACLs for LuCI packages to prevent similar issues.