CVE-2026-23738 Cross-site scripting in asterisk
Attackers can inject malicious scripts into the Asterisk web server status page via unsanitized cookies or query parameters, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23738?
CVE-2026-23738 is a low-severity cross-site scripting vulnerability in asterisk, published on 6 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-23738?
It affects 2 products.
Products include Sangoma Asterisk, Sangoma Certified Asterisk.
How do I fix CVE-2026-23738?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-23738 being exploited?
There is no known exploitation of CVE-2026-23738 in the wild and no public exploit code.
Other vulnerabilities in asterisk
- CVE-2024-57520 Path traversal in n/a
- CVE-2025-47779 Using malformed From header can forge identity with ";" or NULL in name portion
- CVE-2025-57767 Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
- CVE-2022-37325 Memory corruption in n/a
- CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
Sources
Also known as DEBIAN-CVE-2026-23738, GHSA-v6hp-wh3r-cwxh, UBUNTU-CVE-2026-23738.