CVE-2026-26422: clash-verge-service-ipc before 2

Synopsis

A local privilege escalation vulnerability exists in the clash-verge-service-ipc component of Clash Verge Rev before version 2.3.0. The service exposes an IPC (inter-process communication) endpoint that any local process can reach without authentication, meaning no network access or login credentials are required to interact with it. A successful attacker who already has any foothold on the host can abuse this endpoint to read sensitive data, tamper with the system, or execute code at an elevated privilege level. A patched-image rebuild at version 2.3.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable IPC endpoint.

• AuthenticationNot required

  No credentials or privilege level are required; the IPC endpoint is world-reachable by any local process.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the endpoint directly without any social engineering.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout requirements apply.

Blast Radius

• A successful attacker reads sensitive data from the host system, including files and secrets accessible at elevated privilege levels.
• The attacker modifies system state or configuration by issuing privileged IPC commands through the exposed endpoint.
• The attacker executes code with the privilege level of the clash-verge-service-ipc process, achieving local privilege escalation from an unprivileged foothold.
• All three impact dimensions (confidentiality, integrity, availability) are rated High, meaning the attacker has full control over the affected service and its reachable resources.