CVE-2026-30874

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.

• CWE-74
• CWE-187
• CWE-269

• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw28-hxcm-j934Patch, Vendor Advisory
• https://github.com/openwrt/procd/commit/e08cdc8562f55b9ac228a21f3f7605a18c522b81Patch

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30869SiYuan is a personal knowledge management system. Prior to 3…9.8
• CVE-2026-3087If `shutil.unpack_archive()` is given a ZIP archive with an …7.5
• CVE-2026-30870PowerSync Service is the server-side component of the PowerS…6.5
• CVE-2026-30871OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30872OpenWrt Project is a Linux operating system targeting embedd…9.8
• CVE-2026-30873OpenWrt Project is a Linux operating system targeting embedd…4.9
• CVE-2026-30875Chamilo LMS is a learning management system. Prior to versio…8.8
• CVE-2026-30876Chamilo LMS is a learning management system. Prior to versio…5.3
• CVE-2026-30877baserCMS is a website development framework. Prior to versio…7.2
• CVE-2026-30878baserCMS is a website development framework. Prior to versio…5.3
• CVE-2026-30879baserCMS is a website development framework. Prior to versio…6.1
• CVE-2026-3088Unauthenticated users on the local network can cause the rou…6.5