CVE-2026-56022

Executive Summary

CVE-2026-56022 is an authentication bypass vulnerability in Webmin that allows remote, unauthenticated attackers to bypass mandatory MFA (multifactor authentication) requirements by sending a crafted HTTP request containing the User-Agent: webmin header. The flaw exists in Webmin versions prior to 2.641 and stems from improper handling of basic authentication when a non-standard User-Agent string is supplied. Successful exploitation grants an attacker administrative access to the Webmin web interface without passing the additional MFA challenge, resulting in full compromise of the underlying server. Webmin instances exposed to the internet are at highest risk, and given the public PoC status and EPSS percentile of 41.6%, targeted exploitation is plausible.

Technical Analysis

Webmin implements a multi-layered authentication flow designed to enforce user credentials followed by an optional second factor (MFA). The vulnerability lies in the session-management component that reconciles HTTP Basic Authentication with cookie-based session tokens. When Webmin receives a request with the header User-Agent: webmin, the application treats the request as originating from a trusted internal client (e.g., a Webmin CLI tool or a sister process). In this trusted mode, Webmin accepts the Authorization header containing base64-encoded credentials and authenticates the user without generating or requiring a session cookie, thereby skipping the MFA step that is normally mandatory when a session cookie is present.

The vulnerable code path is triggered in the authentication dispatch logic: if an Authorization header exists and the User-Agent is exactly webmin, the server validates credentials against the local password database and immediately creates an authenticated session — bypassing the MFA check that is applied to all other authentication flows. This behavior is likely a legacy compatibility feature intended for the webmin CLI utility, but it was inadvertently exposed to network-facing endpoints.

The attack surface is the HTTPS/HTTP management port (default 10000, also 10001 for SSL). Because the flaw requires only a valid username and password (no MFA token), any credential leak, weak password, or previously stolen password hash becomes sufficient for full compromise. The attack is purely remote and does not require any prior session or authentication.

Notably, the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that no privileges are required, but the confidentiality impact is High — the attacker gains full administrative read and write access to the server, though the vector omits integrity impact, likely an oversight in scoring. The real-world impact includes arbitrary command execution via Webmin's command modules, file read/write, and credential harvesting.

Exploitation Scenarios

1. Reconnaissance: An attacker scans the internet for hosts exposing Webmin on port 10000 or 10001 using Shodan dorks such as http.title:"Webmin" or product:"Webmin". The attacker identifies targets running version < 2.641 by fingerprinting the login page or version banner.

2. Credential Acquisition: The attacker obtains valid credentials through one of several means: brute-force (weak admin passwords), a previous data breach containing Webmin credentials, or credential stuffing using lists from prior breaches. No MFA token is needed — that is the core flaw.

3. Weaponization: The attacker crafts a raw HTTP request to the Webmin login endpoint (e.g., /session_login.cgi or /) with two specific headers:

   Authorization: Basic base64(username:password)
   User-Agent: webmin
   

   Using curl:

   curl -k -X POST https://target:10000/session_login.cgi \
     -H "User-Agent: webmin" \
     -H "Authorization: Basic YWRtaW46c3VwZXJzZWNyZXQ=" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "page=/&user=admin&pass=supersecret"
   

4. Authentication Bypass: The server validates the credentials and issues a session token or grants immediate access, skipping the MFA prompt. The response contains a sid cookie or sets an authenticated session flag.

5. Post-Exploitation: With an authenticated administrative session, the attacker:

   • Executes arbitrary shell commands via the "Commands" module (/cgi-bin/command.cgi) or "System" > "Shell" (/cgi-bin/shell.cgi), achieving RCE.
   • Reads sensitive files (e.g., /etc/shadow, database configs) via the file manager module.
   • Installs a persistent backdoor by modifying Webmin modules or scheduling cron jobs.
   • Lateral movement: pivot to internal network using the compromised host as a jump box.

Because the MFA was the only barrier against credential theft, the attack chain is simple, fully remote, and requires no user interaction.

Impact Assessment

• Availability Impact: Low (not directly affected by the CVE, but post-exploitation likely causes service disruption).
• Integrity Impact: High (attacker gains administrative write access, can modify system files, plant backdoors).
• Confidentiality Impact: High (full server compromise, data exfiltration).
• Blast Radius: Any Webmin instance with exposed management port and known/weak credentials. This includes enterprise web servers, small-office NAS devices, and IoT appliances that often ship with Webmin. The Common Weakness Enumeration is CWE-287 (Improper Authentication) — the failure to enforce all authentication factors.
• Business Impact: Full control of the web server or appliance, potential data breach, regulatory fines (GDPR/HIPAA), and reputational damage. The EPSS score of 0.00525 (41.6th percentile) indicates moderate likelihood of exploitation in the wild.
• CVSS Subscores: Confidentiality 3.6 (High), Integrity 0.0 (None per scoring, but actual is High), Availability 0.0 (Low per scoring, but actual is Medium). The vector misrepresents real impact.

Detection Guidance

Sigma Rule

title: Webmin MFA Bypass via User-Agent Header
id: 8f5c2a91-3b2e-4d9a-a829-6a34821c0d4e
status: experimental
description: Detects requests to Webmin with User-Agent "webmin" and Basic Authentication header, which can bypass MFA (CVE-2026-56022).
logsource:
  category: webserver
  product: apache
  definition: Webmin runs on Apache or its own server; web server logs.
detection:
  selection:
    cs-user-agent: "webmin"
    cs-method:
      - POST
      - GET
    cs-uri-query|contains:
      - "session_login.cgi"
      - "session_acl.cgi"
      - "useradmin"
  filter_known_clients:
    cs-user-agent: "webmin"
    cs-host: "127.0.0.1"  # legitimate local CLI use
  condition: selection and not filter_known_clients
level: high
falsepositives:
  - Internal health checks using webmin CLI (rare)
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.56022

YARA Rule

rule Webmin_MFA_Bypass_UA
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects Webmin MFA bypass requests using User-Agent webmin"
        cve = "CVE-2026-56022"
        date = "2026-05-15"
    strings:
        $ua = "User-Agent: webmin" ascii nocase
        $auth = "Authorization: Basic " ascii nocase
        $login = "session_login.cgi" ascii nocase
        $login2 = "session_acl.cgi" ascii nocase
        $failed = "login failed" ascii nocase
    condition:
        $ua and $auth and ($login or $login2) and not $failed
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-56022 Webmin MFA Bypass via User-Agent"; flow:established,to_server; http.user_agent; content:"webmin"; nocase; http.method; content:"POST"; http.uri; content:"session_login.cgi"; nocase; http.header_names; content:"Authorization"; classtype:attempted-admin; sid:202656022; rev:1; metadata:created_at 2026-05-15, cve CVE-2026-56022;)

Elastic Detection (EQL)

sequence by host.name, source.ip with maxspan=5s
  [http where method == "POST" and url.path == "/session_login.cgi" and 
   headers.user_agent == "webmin" and headers.authorization != null]
  [http where method == "POST" and url.path == "/session_login.cgi" and 
   url.path == "/session_login.cgi" and headers.response ~ "200"]

Splunk SPL Query

index=webmin sourcetype=access_combined 
| where UserAgent="webmin" AND method="POST" AND uri_path="/session_login.cgi"
| eval has_auth_header=if(match(HEADERS, "Authorization"), 1, 0) 
| where has_auth_header=1
| stats count by src_ip, user, uri, _time
| table _time, src_ip, user, uri, count
| sort - _time

Wazuh OSSEC Rule

<rule id="100562" level="12">
  <if_sid>31122</if_sid>  <!-- Apache web server access log rule -->
  <match>User-Agent: webmin</match>
  <regex>Authorization: Basic</regex>
  <description>Webmin MFA bypass attempt via User-Agent header (CVE-2026-56022)</description>
  <group>webmin,attack,authentication,failed_authentication,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — a patch version (2.641) is claimed by OSV, but the vendor fix is marked "N/A" and no official advisory from Webmin has been independently confirmed. Treat this as a credible but unverified patch claim.

1) Immediate Mitigations (before patching):

• Block external access to Webmin ports 10000/10001 at the firewall. Restrict access to trusted internal IPs only.
• Enable IP-based allowlisting in Webmin's access control (Webmin → Webmin Configuration → IP Access Control).
• Change all Webmin admin passwords immediately, especially those reused elsewhere.
• Disable HTTP Basic Authentication if possible; force cookie-based login only (via Webmin config or reverse proxy stripping Authorization header).
• Monitor logs for User-Agent: webmin with Authorization headers — alert on any such request.
• Segment the network: isolate Webmin hosts from critical internal segments until patched.

2) Patch/Upgrade Steps:

• Upgrade to Webmin 2.641 or later. This is the version claimed to fix the issue.
• If 2.641 is not yet available from your distribution channel, check the Webmin official site (webmin.com) and the GitHub repository for a security release.
• Verify the patch by testing: attempt the exploit with User-Agent: webmin and confirm MFA is now enforced.
• After upgrading, verify MFA enforcement by performing a test login with and without the MFA token.

3) Long-Term Hardening:

• Enforce strong MFA using TOTP (Google Authenticator) for all Webmin users; ensure MFA tokens are mandatory, not optional.
• Use a reverse proxy (nginx/apache) in front of Webmin to strip User-Agent: webmin headers from external requests before they reach the application.
• Implement rate limiting on login endpoints to slow brute-force attacks.
• Rotate credentials regularly and avoid password reuse.
• Subscribe to Webmin security advisories (webmin.com/security.html) and apply patches within 24 hours for critical issues.
• Consider replacing Webmin with a more modern, actively maintained admin interface if the instance handles sensitive data.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-56022 (NVD description, CVSS vector, CWE).
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-56022 (Patch claim source, single vendor reference).
3. Webmin Official Site: https://www.webmin.com/ (For version 2.641 download and changelog; vendor advisory not yet published).
4. CISA KEV: Not listed — CVE-2026-56022 is not in the CISA Known Exploited Vulnerabilities catalog as of this report.
5. Exploit-DB / GitHub: Public PoC descriptions circulating in researcher channels; no verified exploit code published. No known threat actor campaigns have been publicly attributed to this CVE at the time of writing, but the public PoC status raises the risk of imminent weaponization.