ajenti.plugin.core has password bypass when 2FA is activated

高 7.5CVE-2026-40177 · GHSA-3mcx-6wxm-qr8v · PYSEC-2026-266 · 10/04/2026 公開 · 17/06/2026 更新

要点

CVE-2026-40177 は ajenti-plugin-core, ajenti plugin core (ajenti) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.33%（全脆弱性の 26.1% より高い）。
対処：0.112 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ajenti-plugin-core PyPI	`< 0.112`	`0.112`
ajenti plugin core ajenti	`< 0.112`	`0.112`

概要

Impact

If the 2FA was activated, it was possible to bypass the password authentication

Patches

This is fixed in the version 0.112. Users should upgrade to this version as soon as possible.

NVD の説明

ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.