CVE-2026-66088

CVSS 9.4 (critical) · published 2026-10-29

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Weakness: CWE-78, CWE-749

Source: NVD CVE-2026-66088

References

• https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4v
• https://openequella.github.io/guides/

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.