CVE-2026-79920criticalCWE-862

CVE-2026-79920: critical vulnerability in ajenti

Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Published

Follow this CVE+ Monitor ajenti

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 0.6%
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
ajenti · ajenti
Related CVEs — ajenti

In the same product, most dangerous first.

CVE-2026-27975HIGHAjenti has a potential Remote Code ExecutionEPSS 0.6%CVE-2026-40177CRITICALPassword bypass when 2FA is activatedEPSS 0.3%CVE-2026-35175HIGHAjenti has an authorization bypass during custom package installationEPSS 0.3%CVE-2026-40178MEDIUMajenti.plugin.core has a race conditions in 2FAEPSS 0.2%