CVE-2026-45344: LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances

Synopsis

Newline injection in the setup database-password field affects LinkAce, a self-hosted link archive application. A remote attacker with no authentication can reach the setup endpoint on any uninitialized instance over the network and supply a crafted database password that injects arbitrary lines into the application's .env configuration file, including mail-handler directives. Once the application sends mail, those injected directives execute attacker-supplied commands, achieving remote code execution. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the LinkAce setup endpoint over the network; only internet-exposed or network-reachable uninitialized instances are at risk.

• AuthenticationNot required

  No account or credentials are needed; the setup endpoint is publicly accessible on uninitialized instances by design.

• Victim interactionNot required

  No user action is required; the attacker sends crafted HTTP requests directly to the setup endpoint.

• Attack complexityDetail

  Exploitation requires the attacker to control a database server and wait for the application to send mail, introducing environmental dependencies that make reliable exploitation harder.

Blast Radius

• The attacker executes arbitrary operating-system commands in the context of the LinkAce application process.
• Successful command execution exposes all stored link archives, user account data, and any secrets held in the application environment.
• The attacker can modify or delete persisted database records, corrupting the link archive.
• The attacker can crash or permanently disable the LinkAce service by terminating the application process or destroying its configuration.