CVE-2026-35175: Ajenti Panel Authorization Bypass During Custom Package Installation
Summary
CVE-2026-35175: Ajenti has an authorization bypass during custom package installation. Affects ajenti-panel versions < 2.2.15. Fixed in 2.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ajenti is an open-source control panel that allows users to manage their servers through a web interface. It is built using Python and is designed to provide a user-friendly experience for server management. The ajenti-panel package is a core component of Ajenti, enabling various functionalities including package management. However, it has been found to have a significant security vulnerability that allows unauthorized users to install custom packages, potentially compromising the server's integrity.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the ajenti-panel package, specifically when using the auth_users plugin for authentication. An authenticated user, even without superuser privileges, can install custom packages. This flaw can lead to unauthorized modifications to the server environment, allowing malicious users to introduce harmful software or alter configurations without proper permissions. The vulnerability is classified under CWE-862, indicating a lack of proper access control.
How To Fix
Latest published version: 2.2.17 as of 23 Oct 2026
pip install --upgrade "ajenti-panel==2.2.17"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.15
This is the first release that contains the fix.
pip install --upgrade "ajenti-panel==2.2.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is recommended to restrict access to the Ajenti control panel to trusted users only. Additionally, consider disabling the ability for non-superuser accounts to install custom packages until the upgrade can be performed.
Conclusion
The discovery of CVE-2026-35175 highlights a critical authorization bypass vulnerability in the Ajenti Panel, allowing unauthorized users to install custom packages. It is essential for users to upgrade to version 2.2.15 to mitigate this risk and ensure the security of their server environments.
See every vulnerability recorded for ajenti-panel →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability could lead to unauthorized access and control over your server, potentially resulting in data breaches or service disruptions.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the Pipfile.lock, making it easier to stay informed about potential risks.
If an immediate upgrade is not possible, ensure that access to the Ajenti control panel is limited to trusted users and consider disabling custom package installation for non-superusers.
References
Related vulnerabilities
Recent vulnerabilities recorded for ajenti-panel.
