CVE-2026-79920

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920

The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920: Missing Authorization

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

PT-2026-96164

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16 Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring...

ajenti.plugin.core has race conditions in 2FA

ImpactIf the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. PatchesThis is fixed in the version 0.112. Users should upgrade to this version as soon as possible...

PYSEC-2026-2340 ajenti.plugin.core has race conditions in 2FA

Impact If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible...

Ajenti has an authorization bypass during custom package installation

ImpactAn authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. PatchesThis is fixed in the version 2.2.15. Users should upgrade to this version as soon as possible...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the authusers plugin authentication method, an authenticated user could install a custom package even if this user is not a superuser. Remediation Upgrade ajenti-panel to version 2.2.15 or higher. References -...

Improper Restriction of Rendered UI Layers or Frames

Overview ajenti is a Linux & BSD web admin panel. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames through the lack of anti-framing protections in the HTTP response process. An attacker can trick users into interacting with a maliciously...

EUVD-2026-41978

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979: Improper Restriction of Rendered UI Layers or Frames

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979

The ajenti web admin panel (versions through v2.2.13 ) contains a clickjacking weakness in its browser-facing login and administrative UI. The root cause is located in ajenti-core/aj/http.py, where the core HTTP response path initializes an empty header list and finalizes responses via WSGI start...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

PT-2026-56023

Name of the Vulnerable Software and Affected Versions ajenti versions prior to 2.2.14 Description The browser-facing login and administrative UI contains a clickjacking weakness. This occurs because the core HTTP response path in ajenti-core/aj/http.py initializes an empty header list and finaliz...