CVE-2026-26093: Command Injection in Owl OPDS
CVE-2026-26093 is a command injection flaw (CWE-77) in Owl OPDS 2.2.0.4 that can be triggered by a crafted network request. The NVD assigns it a critical CVSS score of 9.8, and the CNA Nozomi Networks reports 8.7 under CVSS version 4.0. The record shows no confirmed exploitation and no fixed version.
Overview
CVE-2026-26093 describes a command injection weakness (CWE-77) in Owl OPDS 2.2.0.4. According to the record, special elements in input are not properly neutralized before being used in a command, and a crafted network request can trigger this. The CVE was published on 2026-02-20 and its CNA is Nozomi Networks.
Impact
- The NVD base score is 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability.
- The Nozomi Networks score is 8.7 under CVSS version 4.0.
- Command injection typically allows an attacker to make the affected host run unintended operations. The exact impact in a given deployment depends on the privileges of the affected service, which the record does not describe.
Affected products and versions
- Owl Opds: versions up to and including 2.2.0.4.
- Owlcyberdefense Opds-talon: version 2.2.0.4.
The record does not state whether earlier or later builds are affected beyond these entries.
Exploitation status
The record indicates the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability of exploitation is 0.01981 (percentile 0.80412), which is a statistical estimate, not evidence of attacks.
Remediation and mitigation
- No fixed version is listed in the record. This is unknown, not evidence that no fix exists. Check the Nozomi Networks advisory and the vendor for updated builds.
- Inventory all deployments of Owl OPDS and Opds-talon, including version 2.2.0.4, and prioritise systems reachable from untrusted networks.
- Restrict network exposure of the affected service to trusted hosts and segment it from general user networks until a fix is applied.
- Apply the vendor's updates when available and verify the installed version afterwards.
Detection guidance
- Review logs of the affected service for unexpected child processes, unusual system command activity, or requests with unexpected special characters.
- Monitor network traffic to the service for anomalous sources or volumes, and alert on new outbound connections from the host.
- Treat any sign of unexpected command execution on an affected host as a potential compromise and follow your incident response procedure.
Limitations of the available information
The record does not describe the exact request parameters, the authentication requirements, the component affected inside the product, or any vendor patch. It also does not confirm exploitation, public proof-of-concept code, or the reasons for the differences between the NVD and Nozomi scores. These points remain unknown.
Frequently asked questions
Which products are affected by CVE-2026-26093?
The record lists Owl Opds up to and including 2.2.0.4, and Owlcyberdefense Opds-talon version 2.2.0.4.
Is CVE-2026-26093 known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.01981.
Is there a fixed version?
No fixed version is listed in the record. This is unknown, so check the Nozomi Networks advisory and the vendor for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.