TL;DR: CVE-2026-72842 is an access control inconsistency in luci-app-lxc, the LXC container management app for OpenWrt's LuCI web interface. A low-privileged authenticated user can reach backend container routes that should require admin rights, then use path traversal in the lxc_name parameter to escape the container directory and control host-side scripts run through lxc.hook.start-host. The chain ends in root code execution on the OpenWrt host.

What the bug does

The failure is in two layers that compound. First, the ACL check. LuCI gates its container management routes behind an access control list, but the rules in luci-app-lxc do not match the backend routes they are meant to protect. A user holding only a low-privilege role, such as a basic read-only account, can still reach the container management endpoints. The authorization boundary is simply not there.

Second, the path traversal. The lxc_name parameter is passed to the backend without sanitization. A value carrying the encoded sequence /.%2E resolves outside the intended container directory, because %2E is a URL-encoded dot and the decoded path climbs out of the container root. The name field becomes a file path, and the file path escapes.

That escape is what makes this severe. LXC supports a configuration key named lxc.hook.start-host, a hook that runs a command on the host when a container starts. An attacker who can write container configuration through the web UI can point that hook at a host-side script. The hook executes as root, because LXC container management on OpenWrt runs with host privileges. Container name traversal plus a host hook equals root code execution.

Who is affected

OpenWrt devices with luci-app-lxc installed. OpenWrt is an open-source Linux operating system for embedded devices, and it is one of the most widely deployed router firmware projects in the world. It runs on millions of consumer routers, access points, and network appliances, and it is the base for commercial products and for projects like Turris and GL.iNet devices. LuCI is the web management interface those boxes expose to their administrators.

luci-app-lxc is the LuCI package that adds LXC (Linux Containers) management to that interface. It is not installed by default on most OpenWrt builds, so the exposure is on devices where an admin enabled container management. The attack requires an authenticated LuCI session first. The vulnerability does not remove the login requirement. It removes the privilege requirement: any authenticated user, even one with minimal rights, can reach the container management routes and drive the traversal.

What to do

If you run luci-app-lxc, restrict LuCI access to trusted administrators and remove low-privilege accounts until a patched release is available. Watch the upstream advisory for the fixed version, then update the package with opkg update && opkg upgrade luci-app-lxc once the patched build lands in your OpenWrt branch.

Audit existing containers for lxc.hook.start-host entries that point at unexpected scripts, and inspect container names for traversal sequences. A container whose name contains encoded dots, or whose host hook was not set by you, is a signal that the box has been touched.

Why it matters

Root on a router is not the same as root on a server. The device sits at the edge of the network, so an attacker who owns it can intercept and redirect traffic, pivot into the LAN, and persist in firmware that survives most reinstall procedures. For a network appliance, the privilege boundary is the whole security model, and this CVE removes it for anyone with a login.

The record is not marked as known exploited, and no CVSS score is published yet. That is a data gap, not an all-clear. The advisory describes a concrete root code execution path, and the affected component is a management interface that admins expose to a network. NVD enrichment is still pending at the time of writing.

References

• OpenWrt luci GitHub advisory (GHSA-jf59-v86x-fwf2)
• VulnCheck advisory
• HOL Guard CVE record