{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "Webmin multiple vulnerabilities",
    "tracking": {
      "current_release_date": "2026-08-11T15:32:46Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-169-02",
      "initial_release_date": "2026-06-18T15:56:50Z",
      "status": "final",
      "version": "2.0.0",
      "revision_history": [
        {
          "number": "2.0.0",
          "summary": "Content Update",
          "date": "2026-08-11T15:32:46Z"
        },
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-06-18T15:56:50Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Update to most recent available version of Webmin.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "United States",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json",
        "summary": "Vulnerability Advisory VA-26-169-02 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Webmin",
        "branches": [
          {
            "category": "product_name",
            "name": "Webmin",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "Webmin Webmin vers:all/*",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.640",
                "product": {
                  "name": "Webmin Webmin <2.640",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "2.640",
                "product": {
                  "name": "Webmin Webmin 2.640",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.202",
                "product": {
                  "name": "Webmin Webmin <2.202",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version",
                "name": "2.202",
                "product": {
                  "name": "Webmin Webmin 2.202",
                  "product_id": "CSAFPID-0005"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "Webmin",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "Webmin Webmin vers:all/*",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.640",
                "product": {
                  "name": "Webmin Webmin <2.640",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "2.640",
                "product": {
                  "name": "Webmin Webmin 2.640",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.202",
                "product": {
                  "name": "Webmin Webmin <2.202",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "2.202",
                "product": {
                  "name": "Webmin Webmin 2.202",
                  "product_id": "CSAFPID-0010"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "Webmin",
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "Webmin Webmin vers:all/*",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.640",
                "product": {
                  "name": "Webmin Webmin <2.640",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version",
                "name": "2.640",
                "product": {
                  "name": "Webmin Webmin 2.640",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version_range",
                "name": "<2.202",
                "product": {
                  "name": "Webmin Webmin <2.202",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version",
                "name": "2.202",
                "product": {
                  "name": "Webmin Webmin 2.202",
                  "product_id": "CSAFPID-0015"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56020",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2026-05-29T20:04:47Z/"
        }
      ],
      "title": "Webmin HTTP header authentication bypass",
      "product_status": {
        "known_affected": [
          "CSAFPID-0004"
        ],
        "fixed": [
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/webmin/webmin/releases/tag/2.202"
        },
        {
          "category": "external",
          "summary": "webmin.com",
          "url": "https://webmin.com/security/#webmin-prior-to-2202"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56020"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0004"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.202.",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.202.",
          "product_ids": [
            "CSAFPID-0005"
          ]
        }
      ],
      "acknowledgments": [
        {
          "organization": "vulone.com/vul1.com",
          "names": [
            "Adem El Adeb"
          ]
        }
      ],
      "release_date": "2026-06-18T00:00:00Z"
    },
    {
      "cve": "CVE-2026-56021",
      "cwe": {
        "id": "CWE-185",
        "name": "Incorrect Regular Expression"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2026-05-29T20:05:32Z/"
        }
      ],
      "title": "Webmin information disclosure via regex pattern",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56021"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "No fix planned.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "acknowledgments": [
        {
          "organization": "vulone.com/vul1.com",
          "names": [
            "Adem El Adeb"
          ]
        }
      ],
      "release_date": "2026-06-18T00:00:00Z"
    },
    {
      "cve": "CVE-2026-56022",
      "cwe": {
        "id": "CWE-308",
        "name": "Use of Single-factor Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:P/2026-05-29T20:06:09Z/"
        }
      ],
      "title": "Webmin MFA bypass",
      "product_status": {
        "known_affected": [
          "CSAFPID-0002"
        ],
        "fixed": [
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "webmin.com",
          "url": "https://webmin.com/security/#webmin-prior-to-2640"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/webmin/webmin/releases/tag/2.640"
        },
        {
          "category": "external",
          "summary": "raw.githubusercontent.com",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-169-02.json"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56022"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.640.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.640.",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "acknowledgments": [
        {
          "organization": "vulone.com/vul1.com",
          "names": [
            "Adem El Adeb"
          ]
        }
      ],
      "release_date": "2026-06-18T00:00:00Z"
    }
  ]
}