CVE-2026-126781 is a high-severity (CVSS 7.5) CWE-93 vulnerability in webmin webmin. Versions up to 2.670 are affected; the records list no fixed version yet, so check the vendor advisory below.
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate…
Description
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash and newline to add a second root entry with a known password hash, gaining Webmin root access after miniserv restarts.
Affected Products
webminwebminDetection & mitigation playbook
Vendor / applianceDetect
Inventory every webmin webmin deployment and check each version against the affected-products list above.
Remediation status
The records we use list no fixed version for CVE-2026-126781 (versions up to 2.670 are affected). Check the webmin webmin advisory for a patched release, and apply the workarounds below until you can upgrade.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126781 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.