{"id":"CVE-2026-28279","aliases":["GHSA-rchw-322g-f7rm","GO-2026-4579"],"url":"https://o3.security/vulnerability/CVE-2026-28279","summary":"`osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration","details":"### Summary\nAn OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These commands are embedded into enrollment one-liner scripts generated using Go's `text/template` package (which does not perform shell escaping) and execute on every endpoint that enrolls using the compromised environment.\n\n### Impact\nAn attacker with administrator access can achieve remote code execution on every endpoint that enrolls using the compromised environment. Commands execute as root/SYSTEM (the privilege level used for osquery enrollment) before osquery is installed, leaving no agent-level audit trail. This enables backdoor installation, credential exfiltration, and full endpoint compromise.\n\n### Patches\nFixed in osctrl `v0.5.0`. Users should upgrade immediately.\n\n### Workarounds\nRestrict osctrl administrator access to trusted personnel. Review existing environment configurations for suspicious hostnames. Monitor enrollment scripts for unexpected commands.\n\n### Credits\n\nLeon Johnson and Kwangyun Keum from TikTok USDS JV Offensive Security Operations (Offensive Privacy Team)\n\nhttps://github.com/Kwangyun → @Kwangyun\nhttps://github.com/sho-luv → @sho-luv","published":"2026-02-26T22:59:29.972Z","modified":"2026-10-28T02:30:30.876081109Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jmpsec/osctrl","fixedVersion":"0.5.0"}],"fix":{"url":"https://github.com/jmpsec/osctrl/pull/777","label":"jmpsec/osctrl#777"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28279.json"},{"type":"ADVISORY","url":"https://github.com/jmpsec/osctrl/security/advisories/GHSA-rchw-322g-f7rm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28279"},{"type":"FIX","url":"https://github.com/jmpsec/osctrl/pull/777"},{"type":"FIX","url":"https://github.com/jmpsec/osctrl/pull/780"},{"type":"PACKAGE","url":"https://github.com/jmpsec/osctrl"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:30.876081109Z"}}