CVE-2026-40177
High
Description
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAjenti Plugin Core
PublishedApr 10, 2026
First seenApr 10, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- ajenti ajenti_plugin_core0.112 or later
- ajenti-plugin-core0.112 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ajenti ajenti_plugin_core | v < 0.112 | 0.112 |
| ajenti-plugin-corePyPI | v < 0.112 | 0.112 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.