Skip to content
Open-AudIT. What's on your network?

Security Advisory: Update to Open-AudIT 5.6.2 or 6.0.1

Open-AudIT Security Team · 2026-01-08 · Security

Severity: High CVE: CVE-2026-00142 (pending NVD publication) Affected versions: Open-AudIT < 5.6.2 and < 6.0.1 Fixed in: 5.6.2, 6.0.1

Summary

A vulnerability has been identified in the Open-AudIT credential storage subsystem that could allow an authenticated user with administrator privileges to read encrypted credentials in plaintext under specific conditions.

We are not aware of any active exploitation of this vulnerability in the wild.

Impact

  • Authentication required: Yes. This issue requires a valid administrator account
  • Network exposure: Only exploitable from within the Open-AudIT web interface
  • Data at risk: SNMP community strings and WMI passwords stored as credentials in Open-AudIT

Mitigation

Update to Open-AudIT 5.6.2 or Open-AudIT 6.0.1 immediately.

If you are unable to upgrade immediately, as a temporary mitigation:

  1. Restrict Open-AudIT web interface access to trusted IP addresses via your firewall or web server configuration
  2. Audit your administrator accounts and remove any accounts that should not have admin access
  3. Rotate all SNMP community strings and WMI passwords stored in Open-AudIT after upgrading

Upgrading

Ubuntu/Debian

sudo apt update
sudo apt install open-audit

Or download the updated .deb from open-audit.org/download/.

Windows

Download and run the updated installer from open-audit.org/download/. The installer will preserve your existing data and configuration.

Verify your version

After upgrading, confirm you are running the patched version:

# Check the version file
cat /var/www/html/open-audit/version.txt
# Expected output: 5.6.2 or 6.0.1

Or check Admin → About in the Open-AudIT web interface.

Credits

This vulnerability was responsibly disclosed by a member of the open-source security community. We thank them for following responsible disclosure practices.

Contact

If you have questions about this advisory, please contact the security team via security@firstwave.com or open a GitHub issue marked [security].

Do not post exploit details in public forums until a patch has been available for at least 30 days.

Back to the blog