CVE-2026-25856: OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface

Synopsis

Authenticated remote code execution (RCE) affects OpenBullet2 versions through 0.3.2. The vulnerability is reachable over the network by any authenticated user and requires no special privileges beyond a valid account; the job configuration interface accepts raw C# code and executes it on the server without filtering or API restrictions. Successful exploitation gives the attacker arbitrary code execution on the host as the process user, enabling full file system access, process spawning, and unrestricted .NET API calls. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable job configuration interface is exposed over the network, so an attacker must be able to reach the OpenBullet2 service via HTTP/HTTPS.

• AuthenticationRequired

  A valid account is required, but any low-privilege user account is sufficient; no administrative role is needed to create or modify job configurations.

• Victim interactionNot required

  The attacker submits a malicious job configuration directly; no action by another user or administrator is needed to trigger execution.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or environmental prerequisite stands between authentication and code execution.

Blast Radius

• The attacker executes arbitrary C# code on the server as the process user, gaining full control of the running application process.
• The attacker reads, writes, or deletes files anywhere on the host file system that the process user can access, including credentials, configuration files, and stored data.
• The attacker spawns arbitrary child processes on the host, enabling lateral movement, persistence mechanisms, or secondary payload deployment.
• The attacker invokes unrestricted .NET APIs, allowing exfiltration of environment variables, secrets injected at container runtime, and any in-memory application state.