CVE-2026-57999
luci-app-tailscale-community - Command Injection via tailscale.do_login RPC
Description
luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the outer shell before argument processing.
INFO
Published Date :
June 29, 2026, 6:16 p.m.
Last Modified :
June 29, 2026, 6:16 p.m.
Remotely Exploit :
Yes !
Source :
VulnCheck
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 |
Solution
- Sanitize user-supplied loginserver parameters.
- Sanitize user-supplied loginserver_authkey parameters.
- Avoid executing user input directly in shell commands.
- Update to a patched version of luci-app-tailscale-community.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-57999 vulnerability anywhere in the article.