CVE-2026-59683
Description
A flaw was found in the OpenRGB network SDK protocol. Profile names received over the network are used directly in filesystem path construction without sanitization, allowing unauthenticated remote attackers to write attacker-controlled data to arbitrary filesystem paths via path traversal. By default, the daemon listens on all network interfaces (0.0.0.0) on port 6742 with no authentication. Exploitation results in full system compromise when the daemon runs as root, or full account takeover when it runs in user context.
Statement
This Critical flaw in the OpenRGB network protocol allows unauthenticated remote attackers to achieve full system compromise or account takeover. The daemon's default configuration exposes it on all network interfaces without authentication, enabling arbitrary file writes via path traversal. Red Hat Product Security has determined that this vulnerability does not affect any supported Red Hat product. OpenRGB is only available through community repositories (Fedora and EPEL) and is not shipped or supported as part of any Red Hat product offering.
Mitigation
The following steps can reduce exposure to this vulnerability:
Configure the OpenRGB SDK server to bind to localhost only (127.0.0.1) instead of the default 0.0.0.0, preventing remote network access.
Use a firewall to block incoming connections on port 6742 (e.g., firewall-cmd --remove-port=6742/tcp --runtime-to-permanent).
Avoid running the OpenRGB daemon as root to limit the impact of a potential compromise to the current user context.
Disable the OpenRGB SDK server entirely if network control of RGB devices is not required.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories; Modify Files or Directories
The application can operate on unexpected files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
