DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54569: CVE-2026-54569: Remote Code Execution via Missing Authorization and Eval Injection in senaite.core

#security #cve #cybersecurity

CVE-2026-54569: Remote Code Execution via Missing Authorization and Eval Injection in senaite.core

Vulnerability ID: CVE-2026-54569
CVSS Score: 9.8
Published: 2026-08-26

SENAITE LIMS core framework (senaite.core) versions 2.0.0 through 2.6.0 contain a critical vulnerability chain that permits unauthenticated remote code execution. By combining a Missing Authorization flaw (CWE-862) in multiple JSON API endpoints with an Unsafe Evaluation flaw (CWE-95) during custom field deserialization, an attacker can execute arbitrary Python commands. This execution occurs under the privileges of the hosting Zope process, creating severe risk to laboratory systems, physical instrumentation databases, and host system integrity.

TL;DR

An unauthenticated remote attacker can execute arbitrary Python code on the server hosting SENAITE LIMS by chaining missing authorization on JSON API endpoints with unsafe eval operations on record fields.

⚠️ Exploit Status: POC

Technical Details

  • Vulnerability ID: CVE-2026-54569
  • CWE ID: CWE-95, CWE-862
  • Attack Vector: Network
  • CVSS Score: 9.8 (Critical)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Exploit Status: poc
  • KEV Status: false

Affected Systems

  • SENAITE LIMS installations utilizing senaite.core versions 2.0.0 through 2.6.0
  • senaite.core: >= 2.0.0, <= 2.6.0 (Fixed in: 2.7.0)

Code Analysis

Commit: a24d65e

Secure record parsing implementation using ast.literal_eval

Commit: ef4b6d7

Add AccessJSONAPI authorization permission checks on all state-altering API methods

Mitigation Strategies

  • Upgrade senaite.core to version 2.7.0 or higher.
  • Apply commit patches a24d65e99a17ac43c5374ed9f0a60d0fe60d2f74 and ef4b6d73575b0fbc0edc6114e5e025089aaf9eb7 directly.
  • Configure front-end reverse proxies or WAF rules to restrict external network access to the /@@API/ paths.
  • Enforce least-privilege policies for the Zope system daemon.

Remediation Steps:

  1. Analyze active senaite.core installation paths to identify deployed versions.
  2. Modify buildout.cfg configurations to pull senaite.core version 2.7.0.
  3. Run bin/buildout to execute the framework update and restart the backend services.
  4. If buildout is blocked, manually replace the eval execution blocks in jsonapi/init.py and fields/record.py with ast.literal_eval.
  5. Deploy proxy-level controls or WAF configurations to drop external requests targeting API routes.

References

Read the full report for CVE-2026-54569 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)