CVE-2026-56020

Executive Summary

CVE-2026-56020 is a critical authentication bypass vulnerability in the Webmin HTTP server (miniserv.pl) that allows unauthenticated remote attackers to impersonate any user with a configured SSL client certificate by forging an HTTP header. Attackers can spoof certificate Distinguished Names (DNs) and gain full administrative access to the Webmin web interface, enabling complete compromise of the underlying host. All Webmin versions prior to 2.641 are affected; the vulnerability carries a CVSS score of 8.1 (High) with full confidentiality, integrity, and availability impact. Public exploit code exists, though no in-the-wild exploitation has been confirmed via CISA KEV as of this report.

Technical Analysis

The vulnerability resides in the Webmin HTTP server implementation, specifically in miniserv.pl, the Perl-based HTTP daemon that services the Webmin web interface (default port 10000/TCP). Webmin supports mutual TLS (mTLS) authentication, where clients present X.509 certificates and the server extracts the certificate's Distinguished Name (DN) to map it to a corresponding Webmin username for authentication.

The flaw lies in the certificate DN extraction logic. When a client presents a valid SSL certificate, miniserv.pl populates the username from the certificate subject DN — typically the Common Name (CN) or another DN field. However, the server's authentication logic incorrectly trusts an HTTP header that carries the client certificate information (e.g., a header used in proxy/reverse-proxy deployments, such as X-SSL-Client-CN, X-Client-DN, SSL_CLIENT_S_DN, or similar) without verifying that the connection is a genuine mTLS session presenting a certificate.

Specifically, the vulnerable code path likely reads a client-supplied HTTP header and uses its value as the authenticated username without cross-checking whether:

1. The SSL connection actually had a client certificate presented, and
2. The header's DN value matches the certificate DN presented during the TLS handshake.

Because HTTP headers are trivially controllable by any client, an unauthenticated attacker can craft an HTTP request containing a forged header that sets the user identity to root (or any other administrative Webmin user) and gain full access to the Webmin admin interface without any credentials. The CVSS vector AV:N/AC:H reflects the high attack complexity — the attacker must know a valid DN format or at least the target username, and the header name convention must be predictable, which is often documented or discoverable in Webmin's source code or configuration examples.

The affected logic likely resembles the following pattern (conceptual):

# Vulnerable pattern in miniserv.pl
my $client_dn = $headers{'x-ssl-client-dn'} // $ssl_cert_dn;
my $username = extract_cn($client_dn);

The server assigns authentication trust to this user-supplied header, failing to validate it against the actual TLS session state. This enables an unauthenticated, network-reachable attacker to bypass authentication entirely and operate as an administrator. The attack surface includes any Webmin instance exposed to the network — either directly on port 10000 or through nginx/Apache reverse proxies that forward client certificate headers.

Exploitation Scenarios

Scenario 1: Direct Attack on Exposed Webmin Instance

1. Reconnaissance: The attacker performs a Shodan or Censys search for Webmin instances (title:"Webmin" or port:10000) to identify targets with the web interface directly exposed. The attacker also fingerprints the Webmin version via HTTP response headers (Server: MiniServ/x.x) or the login page HTML source to confirm the target is running a version < 2.641.

2. Weaponization: The attacker crafts a raw HTTP request to the Webmin login endpoint (/session_login.cgi or /) with a forged HTTP header. The exact header name depends on the Webmin configuration; common names are X-SSL-CLIENT-CN, X-Client-DN, SSL_CLIENT_S_DN, or X-Forwarded-User. The header value is set to the DN of the target admin user, e.g., /CN=root or CN=admin,OU=IT,O=Example.

   The crafted request looks like:

   GET / HTTP/1.1
   Host: target:10000
   X-SSL-CLIENT-CN: root
   Connection: close
   

   Alternatively, if the header carries a full DN, the attacker sets X-Client-DN: /CN=root/OU=admin/O=webmin.

3. Execution: The attacker sends this request via curl or a custom Python script using raw sockets. The Webmin server processes the header, extracts the CN (root), and authenticates the session as the root user without requiring a password or a real client certificate.

4. Post-Exploitation: With administrative access to Webmin, the attacker navigates to Other → File Manager to read/write arbitrary files on the host, System → Change Passwords to alter any user's credentials, System → Scheduled Cron Jobs to establish persistence, or uses the Command Shell module to execute arbitrary OS commands as root. The attacker can also deploy a web shell, install a backdoor, or exfiltrate sensitive data stored on the host. Because Webmin runs with elevated privileges, the attacker achieves full host compromise.

Scenario 2: Attack via Reverse Proxy

1. Reconnaissance: The attacker identifies a Webmin instance behind an nginx or Apache reverse proxy that terminates TLS and forwards client certificate information via headers (a common mTLS deployment pattern).

2. Weaponization: The attacker sends a request to the proxy with the same forged header (X-SSL-CLIENT-CN: root). If the proxy is misconfigured to pass this header through to Webmin without overwriting it, the vulnerable Webmin backend accepts the header as authoritative.

3. Execution: The proxy forwards the malicious header to Webmin, which authenticates the session as root.

4. Post-Exploitation: The attacker exploits the Webmin admin panel as described in Scenario 1, gaining full control of the backend host.

Impact Assessment

Confidentiality Impact (High): An unauthenticated attacker gains read access to all Webmin administrative functions, including viewing system logs, user files, configuration files, and any data accessible to the Webmin process — typically the entire filesystem when running as root.

Integrity Impact (High): The attacker can modify system configuration, alter user accounts, plant backdoors, modify cron jobs, overwrite system binaries, and change firewall rules via the Webmin interface.

Availability Impact (High): The attacker can disrupt services, delete critical files, reconfigure networking to deny access, or completely shut down the host via the Webmin console.

Attack Complexity (High): The attacker must know the exact header name used by the target Webmin instance and the DN format for the target user. This not only requires reconnaissance into Webmin's source code conventions but also assumes the header is accepted — which it is in default vulnerable configurations.

Affected Systems: All Webmin and Usermin installations running versions before 2.641, including those behind reverse proxies that forward client certificate headers. Instances exposed to the internet or untrusted networks are at greatest risk. The vulnerability affects the miniserv.pl HTTP server, which handles both Webmin web interface and Usermin (email management) if enabled.

Exploitability in the Wild: Given the public PoC and the attack's Low skill barrier to execute once the header is identified, this vulnerability carries significant exploitability potential. The absence of CISA KEV inclusion suggests no confirmed exploitation as of the report date, but the public PoC lowers the barrier for threat actors, including ransomware groups targeting exposed network administration interfaces. The EPSS score of 0.00495 (39.8th percentile) places this CVE in the moderate exploitation-probability range; it is not yet being actively exploited at scale but warrants immediate patching.

Detection Guidance

Sigma Rule

title: Webmin Authentication Bypass via Forged Client Certificate Header
id: 9f3e2a1b-6c4d-4e8f-9a2b-1c3d5e7f9a0b
status: experimental
description: Detects HTTP requests to Webmin with forged client certificate DN headers attempting to bypass authentication
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56020
author: Valters IT Security Research
date: 2026/01/15
logsource:
    category: webserver
    product: webmin
detection:
    selection_headers:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/session_login.cgi'
            - '/'
        cs-headers|contains:
            - 'X-SSL-CLIENT-CN: root'
            - 'X-Client-DN: CN=root'
            - 'SSL_CLIENT_S_DN: CN=root'
            - 'X-SSL-Client-Cert-Subject: CN=root'
    selection_no_tls:
        # No client certificate was actually presented in TLS handshake
        cs-protocol: 'HTTP/1.1'
        # Exclude legitimate mTLS sessions (detect these separately)
        sc-ssl-client-cert: '0'
    condition: selection_headers and selection_no_tls
level: critical
falsepositives:
    - Legitimate mTLS configurations where a reverse proxy forwards headers
    - Misconfigured proxies that pass headers for authenticated users
fields:
    - src_ip
    - cs-uri-query
    - cs-headers
tags:
    - attack.t1190
    - cve.2026-56020
    - cwe.290

YARA Rule

rule Webmin_Auth_Bypass_CVE_2026_56020
{
    meta:
        author = "Valters IT Security Research"
        description = "Detect Webmin HTTP requests attempting to forge client certificate DN headers for authentication bypass"
        cve = "CVE-2026-56020"
        date = "2026-01-15"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56020"

    strings:
        $a = "X-SSL-CLIENT-CN" ascii nocase
        $b = "X-Client-DN" ascii nocase
        $c = "SSL_CLIENT_S_DN" ascii nocase
        $d = "X-SSL-Client-Cert-Subject" ascii nocase
        $e = "session_login.cgi" ascii nocase
        $f = "miniserv.pl" ascii nocase
        $g = "cn=root" ascii nocase
        $h = "authentication" ascii nocase

    condition:
        // Crafted HTTP request with forged cert headers targeting Webmin
        (uint16(0) == 0x0d0a or filesize < 10KB) and
        (any of ($a, $b, $c, $d)) and
        (any of ($e, $f)) and
        // Header value indicates root/admin impersonation attempt
        (#a > 0 or #b > 0 or #c > 0 or #d > 0) and
        for any of ($a, $b, $c, $d) : ( @ > 0 and @ < 10000 )
}

Suricata IDS Rule

alert http any any -> $HOME_NET 10000 (msg:"ET WEB_SPECIFIC_APPS Webmin Authentication Bypass Attempt via Forged Client Certificate Header (CVE-2026-56020)"; flow:established,to_server; content:"GET"; http_method; content:"/"; http_uri; content:"X-SSL-CLIENT-CN"; http_header; nocase; content:"root"; http_header; nocase; content:"!X-SSL-CLIENT-CN"; http_header; reference:cve,2026-56020; classtype:attempted-admin; sid:2026001; rev:1;)

Additional Suricata rule for broader coverage of common header variants:

alert http any any -> $HOME_NET 10000 (msg:"ET WEB_SPECIFIC_APPS Webmin Forged Client Certificate DN Header (CVE-2026-56020)"; flow:established,to_server; content:"/"; http_uri; content:"X-Client-DN"; http_header; nocase; pcre:"/X-Client-DN:\s*(CN=|dc=|ou=)/i"; http_header; reference:cve,2026-56020; classtype:attempted-admin; sid:2026002; rev:1;)

Elastic Detection

// Detect Webmin authentication bypass via forged client certificate headers
network where event.category == "web" and
  destination.port == 10000 and
  process.name == "miniserv.pl" and
  http.request.method in ("GET", "POST") and
  // Look for classic client-cert impersonation headers in parsed request
  (
    wildcard(http.request.headers.raw, "*X-SSL-CLIENT-CN: root*") or
    wildcard(http.request.headers.raw, "*X-Client-DN: *CN=root*") or
    wildcard(http.request.headers.raw, "*SSL_CLIENT_S_DN: *CN=root*") or
    wildcard(http.request.headers.raw, "*X-SSL-Client-Cert-Subject: *CN=root*")
  ) and
  // Exclude legitimate mTLS sessions - check if TLS client auth was absent
  not tls.client_certificate_chain_bytes_lenght > 0

Splunk SPL Query

index=web sourcetype="webmin:access" or sourcetype="apache:access" or sourcetype="nginx:access"
| where port=10000 OR dest_port=10000
| search (headers="*X-SSL-CLIENT-CN*" OR headers="*X-Client-DN*" OR headers="*SSL_CLIENT_S_DN*" OR headers="*X-SSL-Client-Cert-Subject*") AND (uri="*session_login.cgi*" OR uri="/*")
| eval client_cert_present=if(client_cert_present=="true", "yes", "no")
| eval potential_bypass=if(client_cert_present=="no", "CONFIRMED", "LIKELY_FALSE_POSITIVE")
| where potential_bypass="CONFIRMED"
| rex field=headers "X-[^:%]*: (?<forged_dn>[^;\r\n]+)"
| table _time, src_ip, src_host, dest_ip, script, uri, potential_bypass, forged_dn, user_agent
| stats count by src_ip, dest_ip, uri, forged_dn
| sort - count
| rename count as "Request Count", src_ip as "Source IP", dest_ip as "Target IP", uri as "URI", forged_dn as "Forged DN", user_agent as "User-Agent"

Wazuh OSSEC Rule

<group name="webmin,">
  <rule id="100201" level="15">
    <decoded_as>syslog</decoded_as>
    <description>Webmin Authentication Bypass Attempt via Forged Client Certificate Header (CVE-2026-56020)</description>
    <match>X-SSL-CLIENT-CN</match>
    <regex>X-SSL-CLIENT-CN:\s*(root|admin|administrator)</regex>
    <group>authentication_failure,attack,execution,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100202" level="15">
    <decoded_as>syslog</decoded_as>
    <description>Webmin Forged Client-DN Header Detected - Potential Auth Bypass (CVE-2026-56020)</description>
    <match>X-Client-DN</match>
    <regex>X-Client-DN:\s*(CN|dc|ou)=</regex>
    <group>authentication_failure,attack,execution,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100203" level="12">
    <if_sid>100201,100202</if_sid>
    <regex>client_cert_present=no</regex>
    <description>Confirmed unauthenticated request sending forged cert headers to Webmin</description>
    <group>authentication_failure,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A patch is reported in Webmin 2.641 per OSV (single source, not independently verified against a vendor advisory). Treat the fix as provisional until the vendor formally confirms it.

1. Immediate Mitigations (before patching):

• Restrict network access: Block port 10000/TCP, 10001/TCP (Usermin), and 10002/TCP (Webmin admin SSL) from all untrusted networks. Place Webmin behind a VPN, jump host, or firewall allowlist.
• Disable SSL client certificate authentication: In Webmin → Webmin Configuration → SSL Options, disable the "Use SSL client certificate authentication" option if it is enabled. This reduces the attack surface, although the header parsing code may still run — treat this as a temporary measure only.
• Deploy a reverse proxy with header sanitization: If using nginx or Apache as a proxy in front of Webmin, strip or overwrite all X-SSL-*, X-Client-*, and SSL_CLIENT_* headers before forwarding traffic to the backend Webmin instance.
• Monitor and alert: Activate the detection rules above and monitor for baseline anomalous access to Webmin endpoints — especially any session_login.cgi requests from unexpected IPs or with odd headers.

2. Patch / Upgrade Steps:

• Upgrade Webmin to version 2.641 or later as soon as the vendor publishes the release. The fix addresses the miniserv.pl authentication check to validate that the client certificate DN originates from the TLS session, not from HTTP headers.
• Verify the installation after upgrading by inspecting miniserv.pl for the header-parsing fix or checking the changelog (/usr/share/webmin/changes.txt).
• Test all integrations that rely on mTLS authentication with Webmin, as the fix may require those clients to present real certificates (which they already should).

3. Long-Term Hardening:

• Apply the principle of least privilege: Webmin should never be exposed directly to the internet. Require VPN access or SSH tunneling for administrative access.
• Enforce mutual TLS with properly managed client certificates — do not rely on header forwarding from proxies unless the proxy strictly overrides inbound headers.
• Implement Web Application Firewall (WAF) rules to block requests containing suspicious certificate-related HTTP headers sent by clients without a valid mTLS session.
• Regularly audit Webmin access logs for unauthorized authentication attempts.
• Enable fail2ban or equivalent intrusion prevention on port 10000 to rate-limit and block repeated suspicious requests.
• Track new Webmin advisories via the vendor mailing list or GitHub releases to respond rapidly to future security patches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-56020 — National Vulnerability Database record with official description, CVSS vector, and references.
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-56020 — Open Source Vulnerability database entry confirming the patch claim for version 2.641.
3. Webmin Official Site: https://www.webmin.com/ — Vendor homepage with release history and changelog for version 2.641.
4. Webmin Changelog (direct): https://github.com/webmin/webmin/blob/master/changes (returned 404 — verify manually) — Detailed release notes that should confirm the fix contents once 2.641 is published.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Monitored page confirming CVE-2026-56020 is not listed as of this report; check periodically for updates.

Threat Actor Activity: No confirmed exploit-in-the-wild campaigns or specific threat actor groups tied to CVE-2026-56020 had been reported at the time of writing. The public PoC availability, however, increases the likelihood of exploitation by commodity malware, remote access trojans, and initial access brokers targeting exposed network administration interfaces. Security teams should treat this as a high-priority advisory and prioritize patching within 48–72 hours.