Three Critical OpenWrt LuCI Flaws Allow Root RCE

Three vulnerabilities in OpenWrt’s LuCI web management interface — two rated CVSS 9.9 critical — let authenticated users escalate to root and execute arbitrary code on the underlying host. OpenWrt runs on a substantial chunk of consumer routers, small-business gateways, and embedded networking hardware worldwide. If you’re running LuCI and haven’t patched, that’s the action item. Everything else below is context.

The three flaws

CVE-2026-72842 — CVSS 9.9 Critical

The LuCI container management app (luci-app-lxc) has an ACL inconsistency: low-privileged authenticated users can reach backend container management routes without proper authorization checks. A path traversal in the lxc_name parameter allows an attacker to escape container directories and control host-side scripts executed through lxc.hook.start-host — which run as root. The GitHub Security Advisory is GHSA-jf59-v86x-fwf2.

CVE-2026-72841 — CVSS 9.9 Critical

The OpenVPN LuCI app (luci-app-openvpn) fails to validate the instance_name2 parameter during file upload. Authenticated users can write arbitrary files outside the intended directory via path traversal, including placing content into system paths that survive reboots — giving persistent root-level access. Advisory: GHSA-jjcx-c284-2qv8.

CVE-2026-72840 — CVSS 8.8 High

An overly permissive ACL definition in luci-mod-system-mounts hands write access to /etc/crontabs/root to users scoped only for mount configuration. Any user in that ACL group can append cron entries via ubus, which the default busybox crond daemon executes as root within a minute. Advisory: GHSA-v5f9-62c7-cw29.

What to do

Fixes are in the upstream OpenWrt LuCI repository. The immediate priority ordering:

1. Update LuCI. If your OpenWrt version has a package update available for the affected apps, apply it now.
2. Block LuCI from the WAN. LuCI should never be reachable from the public internet — only from your local network. Confirm this in your firewall rules.
3. Remove the affected apps if you don’t use them. If you’re not running LXC containers or an OpenVPN server through LuCI, uninstall luci-app-lxc and luci-app-openvpn entirely.
4. Audit LuCI user accounts. Both critical flaws require authentication. The shorter your LuCI user list, the smaller the exposure window.

CVE-2026-72842 and CVE-2026-72841 are the priority — both achieve root code execution via different paths in apps that ship as optional packages. CVE-2026-72840 affects luci-mod-system-mounts, a component that’s closer to the default configuration, so don’t deprioritize it entirely.

Router firmware is notoriously under-patched. If you manage a fleet of OpenWrt devices — in a lab, a field deployment, or an MSP context — this is worth a sweep. OpenWrt’s package manager (opkg) can be scripted, and you’re not going to catch this from the console alone.