CVE-2026-79920 Details
Description
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
A vulnerability in Ajenti prior to version 2.2.16 allows any authenticated user to exploit the /api/core/tasks/start endpoint. This endpoint, which lacked proper authorization checks, could be used to enqueue tasks for installing, uninstalling, or upgrading plugins. The tasks were executed by a worker process running as root, using package specifications constructed from unvalidated user input. As a result, a low-privileged user could manipulate packages installed with root privileges, leading to remote code execution and full host compromise.
Users are advised to upgrade to Ajenti version 2.2.16 or later. If an immediate upgrade is not possible, access to the /api/core/tasks/start endpoint should be restricted at the reverse proxy or firewall level to trusted administrators only.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ajenti/ajenti/commit/3a8cbee32df4c5033796f19af4210011163a6f6e | [email protected] | Source CodeVendor |
| https://github.com/ajenti/ajenti/commit/f07f02e0cdeeb3e528c1d5af28e27fd11623c49c | [email protected] | Source CodeVendor |
| https://github.com/ajenti/ajenti/releases/tag/v2.2.16 | [email protected] | Release NotesVendor |
| https://github.com/ajenti/ajenti/security/advisories/GHSA-j8xf-5fw2-f99q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ajenti | <= 2.2.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |