Zero Radar
← feed
CriticalVulnerabilityCVE-2026-65184updated 26 Oct 2026, 17:57 UTC

wsserver terminal bridge lets unauthenticated users run root commands

A background service runs with full administrator power and builds commands from data sent by clients without checking it. An attacker who can reach it may be able to run any command on the machine as root, without logging in.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker connectsSends crafted WebSocket request to wsserver
  2. 2Unquoted command builtClient fields inserted into shell command
  3. 3Command runs as rootPassed to system() and popen() unchecked
  4. 4Host compromisedAttacker gains full root control
  5. ResultAttacker controls the server as root

What happened

The root-privileged wsserver WebSocket terminal-bridge daemon builds a shell command from client-supplied fields and passes it unquoted to system() and popen(). Its public-key session path also skips the appliance-session check, enabling command injection.

Why it is dangerous: An attacker who reaches the service can take complete control of the host as root, with access to all data and the ability to change or disrupt the system. Devices exposing wsserver to untrusted networks are most at risk.

Are you affected?

You are affected if you run a product that includes the wsserver terminal-bridge daemon with the public-key session path reachable from your network.

unknown

What to do

  1. Check whether your product includes wsserver and whether its WebSocket port is reachable from untrusted networks.
  2. Restrict network access to the wsserver port to trusted management hosts only, as a temporary measure.
  3. Apply the vendor's patched version as soon as it is released, and check the GitHub advisory GHSA-f563-j7vj-6j8f for updates.

Timeline

  1. 26 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 15:21 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 17:57 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-65184 · GHSA-f563-j7vj-6j8f
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 15:16 UTC
On Zero Radar
26 Oct 2026, 15:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 17:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

wsserver terminal bridge lets unauthenticated users run root commands · Zero Radar