CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd
Unauthenticated attackers can create the initial superuser account and achieve root remote code execution via command injection in UpSnap.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49819?
CVE-2026-49819 is a critical authentication bypass vulnerability in seriousm4x UpSnap, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.
Which versions are affected by CVE-2026-49819?
How do I fix CVE-2026-49819?
No fix has been published for CVE-2026-49819 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-49819 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49819 exists.
Sources
Also known as GHSA-w4jr-728f-5jhq.