CVE-2026-56020: Webmin HTTP header authentication bypass

Synopsis

An authentication bypass vulnerability exists in the Webmin HTTP server (miniserv.pl) where a remote attacker can forge an HTTP header to impersonate any user that has a configured SSL client certificate. The flaw is reachable over the network and requires no prior authentication, making it exploitable by any unauthenticated remote party. Successful exploitation gives the attacker full control over the Webmin instance, including the ability to read data, modify configuration, and disrupt services. A patched-image rebuild at version 2.641 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Webmin HTTP server over the network; the service must be exposed on a reachable network interface.

• AuthenticationNot required

  No credentials or existing session are needed; the forged HTTP header alone is sufficient to bypass authentication entirely.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any logged-in user or administrator.

• Attack complexityDetail

  Base exploit mechanics are condition-free and reliable, though the CVSS vector notes an attack requirement of specific target conditions (AT:P), meaning the target must have SSL client certificate authentication configured for at least one user.

Blast Radius

• A successful attacker authenticates as any Webmin user, including the root-equivalent admin account, gaining full administrative access to the host system.
• The attacker can read sensitive configuration files, credentials, and any data accessible through the Webmin interface.
• The attacker can modify system configuration, add or remove user accounts, change scheduled tasks, and alter service settings on the underlying host.
• The attacker can terminate services, reboot the host, or otherwise disrupt availability of the system managed by Webmin.