CVE-2026-12196: hestiacp cronjob flaw lets low-priv

CISO Take

HestiaCP's cronjob feature has a broken access control flaw (CWE-287) that lets a low-privilege panel user rewrite a scheduled job to invoke HestiaCP's own management scripts, which run under passwordless sudo — turning a limited account into full root on the underlying webserver. There is no CVSS score, EPSS data, or CISA KEV listing published for this CVE yet, and no Nuclei template exists, but a public technical write-up (projectblack.io) already documents the exploitation path and a patch PR is merged upstream (hestiacp/hestiacp#5440), so working knowledge is out in the open even without formal severity scoring. This is not an AI/ML-specific vulnerability — HestiaCP is a general-purpose server/hosting control panel, not one of the AI packages this feed tracks — its relevance here is limited to organizations that happen to run AI model-serving, RAG, or agent infrastructure on a server managed through a vulnerable HestiaCP instance. Any team using HestiaCP for hosting should patch immediately to the version incorporating PR #5440, audit cronjob entries for unauthorized changes, and review panel user roles to ensure low-privilege accounts cannot reach cronjob configuration at all. Given the trivial exploitation path (UI-level cronjob edit, no special AI knowledge required) and the public write-up, treat this as a priority patch even though it sits outside the core AI threat surface.

Sources: NVD GitHub Advisory

What is the risk?

Exploitability is high relative to skill required: the attack path is a UI-level broken access control issue (CWE-287) requiring only an existing low-privilege panel account and no AI/ML expertise — sophistication is trivial. Impact is severe (full root/admin takeover of the panel and webserver) but exposure is scoped to organizations actively running HestiaCP, and there is no CISA KEV listing, EPSS score, or Nuclei template indicating mass automated exploitation yet. The existence of a public exploitation write-up (projectblack.io) means the technical bar for a motivated attacker with a HestiaCP account is low, so risk should be treated as high despite the absence of formal severity scoring.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege HestiaCP panel user account.

AML.T0012

Exploitation

Attacker exploits broken access control in the cronjob feature to configure a job that invokes HestiaCP management scripts.

AML.T0050

Privilege Escalation

The cronjob executes the management script under passwordless sudo, running it as root.

Impact

Attacker gains full administrative control of the HestiaCP panel and the underlying webserver, compromising any co-hosted services including AI workloads.

Initial Access

Attacker obtains or already holds a low-privilege HestiaCP panel user account.

AML.T0012

Exploitation

Attacker exploits broken access control in the cronjob feature to configure a job that invokes HestiaCP management scripts.

AML.T0050

Privilege Escalation

The cronjob executes the management script under passwordless sudo, running it as root.

Impact

Attacker gains full administrative control of the HestiaCP panel and the underlying webserver, compromising any co-hosted services including AI workloads.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
hestiacp	—	—	No patch

Do you use hestiacp? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Patch HestiaCP to the version that incorporates the fix in PR #5440 (github.com/hestiacp/hestiacp/pull/5440) as soon as it is available in your update channel. Until patched, restrict cronjob-editing capability to trusted admin-tier accounts only, and audit existing cronjobs for unauthorized entries referencing HestiaCP management scripts. Review sudoers configuration for any passwordless sudo entries tied to HestiaCP scripts and tighten them where feasible. For detection, monitor cron modification logs and sudo execution logs for HestiaCP management binaries triggered from non-admin session contexts, and if any AI/ML services run on the same host, rotate credentials and API keys for those services as a precaution after remediation.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

Annex A.6.2 - AI system infrastructure security

NIST AI RMF

GOVERN 4.1 - Organizational risk management for third-party/infrastructure dependencies

Frequently Asked Questions

What is CVE-2026-12196?

HestiaCP's cronjob feature has a broken access control flaw (CWE-287) that lets a low-privilege panel user rewrite a scheduled job to invoke HestiaCP's own management scripts, which run under passwordless sudo — turning a limited account into full root on the underlying webserver. There is no CVSS score, EPSS data, or CISA KEV listing published for this CVE yet, and no Nuclei template exists, but a public technical write-up (projectblack.io) already documents the exploitation path and a patch PR is merged upstream (hestiacp/hestiacp#5440), so working knowledge is out in the open even without formal severity scoring. This is not an AI/ML-specific vulnerability — HestiaCP is a general-purpose server/hosting control panel, not one of the AI packages this feed tracks — its relevance here is limited to organizations that happen to run AI model-serving, RAG, or agent infrastructure on a server managed through a vulnerable HestiaCP instance. Any team using HestiaCP for hosting should patch immediately to the version incorporating PR #5440, audit cronjob entries for unauthorized changes, and review panel user roles to ensure low-privilege accounts cannot reach cronjob configuration at all. Given the trivial exploitation path (UI-level cronjob edit, no special AI knowledge required) and the public write-up, treat this as a priority patch even though it sits outside the core AI threat surface.

Is CVE-2026-12196 actively exploited?

No confirmed active exploitation of CVE-2026-12196 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12196?

Patch HestiaCP to the version that incorporates the fix in PR #5440 (github.com/hestiacp/hestiacp/pull/5440) as soon as it is available in your update channel. Until patched, restrict cronjob-editing capability to trusted admin-tier accounts only, and audit existing cronjobs for unauthorized entries referencing HestiaCP management scripts. Review sudoers configuration for any passwordless sudo entries tied to HestiaCP scripts and tighten them where feasible. For detection, monitor cron modification logs and sudo execution logs for HestiaCP management binaries triggered from non-admin session contexts, and if any AI/ML services run on the same host, rotate credentials and API keys for those services as a precaution after remediation.

What systems are affected by CVE-2026-12196?

This vulnerability affects the following AI/ML architecture patterns: model serving, hosting infrastructure for AI workloads.

What is the CVSS score for CVE-2026-12196?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

model servinghosting infrastructure for AI workloads

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: Annex A.6.2

NIST AI RMF: GOVERN 4.1

What are the technical details?

Original Advisory

HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administrator users in the application and the underlying webserver.

Exploitation Scenario

An attacker signs up for or compromises a low-privilege HestiaCP panel account (e.g., a reseller or standard user tier). Using the panel's cronjob feature, they modify a scheduled job to invoke one of HestiaCP's internal management scripts, which the system is configured to run via passwordless sudo. When the cron fires, the script executes as root, giving the attacker full administrative control over the panel and, by extension, the underlying webserver — including any AI inference services, model files, or API credentials hosted on that machine.

Weaknesses (CWE)

CWE-287 Improper Authentication CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.