Vulnerabilidades do Ajenti Ajenti
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ajenti Ajenti: 5 registro(s), com versões afetadas e correções.cpe:2.3:a:ajenti:ajenti
CVE-2026-79920
Crítica · 9.9
CWE-862 21/09/2026
Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
CVE-2026-40178
Média · 5.9
CWE-287 10/04/2026
ajenti.plugin.core has a race conditions in 2FA
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.
CVE-2026-40177
Alta · 7.5
CWE-287 10/04/2026
Password bypass when 2FA is activated
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
CVE-2026-35175
Média · 6.5
CWE-862 06/04/2026
Ajenti has an authorization bypass during custom package installation
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
CVE-2026-27975
Crítica · 9.8
CWE-284 26/02/2026
Ajenti has a potential Remote Code Execution
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.