CVE-2026-61876 is a critical vulnerability in the OpenWrt LuCI web interface caused by improper neutralization of input during web page generation. Specifically, DHCPv6 lease hostnames are not correctly encoded before rendering in status tables, enabling an adjacent attacker to inject arbitrary HTML or JavaScript code. This occurs when the attacker sends a DHCPv6 Client FQDN containing script tags. The malicious code executes in the context of the administrator's browser upon viewing the DHCP lease page, leading to a cross-site scripting attack.

Successful exploitation allows an adjacent network attacker to execute arbitrary scripts in the administrator's browser, potentially leading to session hijacking, credential theft, or other administrative interface compromise. The vulnerability affects the confidentiality, integrity, and availability of the administrative session as indicated by the high CVSS vector metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should limit access to the LuCI interface to trusted networks and users only. Avoid viewing DHCP lease pages with untrusted DHCPv6 clients present on the network. Monitor official OpenWrt channels for updates and apply patches promptly once released.