CVE-2026-69096 is an OS command injection vulnerability in OpenWrt luci-app-dockerman affecting LuCI master and openwrt-25.12 snapshots that include the ucode docker_rpc.uc RPC backend. The vulnerability exists because the run_ttyd handler builds a shell command from request parameters (id, cmd, uid) without quoting or using argv-style execution, then passes it to system() in the rpcd root context. The read ACL grants broad ubus access to docker.* and docker.container.*, exposing the docker.container.ttyd_start method which performs mutating operations. An authenticated attacker with only read ACL can inject shell metacharacters to execute arbitrary commands as root via an HTTP POST to /ubus. Versions openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected. No official patch or remediation is known at the time of the advisory.

An authenticated attacker with limited privileges (read ACL on luci-app-dockerman) can escalate privileges to root by injecting arbitrary shell commands via the docker.container.ttyd_start method. This allows full system compromise on affected OpenWrt devices running vulnerable luci-app-dockerman versions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, indicating high impact on confidentiality, integrity, and availability.

No official patch or fix is known as of the advisory date. Users should avoid running vulnerable versions of luci-app-dockerman that include the docker_rpc.uc RPC backend. Versions openwrt-24.10 and openwrt-23.05 are not affected. Monitor the OpenWrt project for updates and apply official patches once available. Restrict access to the luci-app-dockerman read ACL and ubus interface to trusted users only until a fix is released.