CVE-2026-38979 describes a clickjacking weakness in Ajenti up to version 2.2.13. The core HTTP response path in ajenti-core/aj/http.py initializes an empty header list and forwards handler-added headers verbatim but does not add any anti-framing protections before finalizing responses via WSGI start_response(). As a result, the login and administrative UI can be embedded in frames, exposing users to clickjacking risks.

The vulnerability allows an attacker to trick users into interacting with the Ajenti login or administrative interface through a maliciously crafted frame, potentially leading to unauthorized actions or credential disclosure via social engineering. The CVSS score of 5.4 (medium severity) reflects limited confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing external mitigations such as web application firewalls or reverse proxies that add appropriate anti-framing headers (e.g., X-Frame-Options: DENY or Content-Security-Policy frame-ancestors) to responses from Ajenti. Monitor vendor communications for official patches or updates.