External risk intelligence

OpenChamber Unauthenticated Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-53975

The vulnerability exists in an API endpoint (/api/fs/exec) and affects default Docker deployments where authentication is disabled by default. Because the product is designed as an internet-facing service with an exposed API and unauthenticated access by default, it is very likely to be reachable from the internet.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpenChamber allows unauthenticated remote attackers to execute arbitrary shell commands by sending specially crafted POST requests to an API endpoint. This could enable unauthorized access and control over affected systems.

Unauthenticated code execution via API.
Affects systems with default configurations.
Confirm relevance and exposure for security posture.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted POST requests to the application's `/api/fs/exec` endpoint. This endpoint, when authentication is not configured, allows attackers to directly inject and execute arbitrary operating system commands. The application then returns the full command output, enabling attackers to observe the results of their actions.

No authentication required.
Triggered via crafted POST requests.
Enables arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

When the `UI_PASSWORD` is not configured, this vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on the server. This could lead to the compromise of the application user's privileges and access to server output.

Server commands could be executed.
Unauthenticated POST requests to API.
Arbitrary OS commands and server output.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability likely impacts application owners and platform teams responsible for the OpenChamber deployment. The immediate first step is to identify all instances of OpenChamber, confirm their exposure and business criticality, and then coordinate remediation with the accountable owners, possibly involving vendor management if the default Docker deployment is used.

Identify accountable application owners.
Verify instance exposure and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenChamber?

OpenChamber is a software tool often used in containerized environments, such as Docker, to manage and interact with filesystem operations via a web-based interface. It provides an API that allows users to perform system-level tasks remotely. Because it is frequently deployed as a service, it is often configured to listen for incoming web requests to facilitate these management functions.

What does CVE-2026-53975 mean?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command, known as CWE-78. In plain English, the software takes input from a user and passes it directly to the system's command processor without checking if it is safe. Because of this, an attacker can supply their own malicious commands, which the server will execute with the same permissions as the application itself.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted POST request to the /api/fs/exec endpoint. The bug occurs because the application lacks validation and skips authentication when a specific password configuration is missing. Notably, simply browsing to the site or sending standard, non-malicious requests to other parts of the application does not trigger the vulnerability; it requires specifically targeting that API endpoint with malicious input.

How likely am I to be affected?

If you are running OpenChamber, your risk depends on your network configuration. Halo Surface Signal identifies this as very likely to be reachable from the internet because the software is often deployed as a web-facing service with an exposed API. If your instance is internet-facing and lacks the UI_PASSWORD configuration, it is accessible to remote attackers without needing any prior credentials.

What should I do to address this?

Begin by auditing your environment to locate all running instances of OpenChamber. Prioritize those that are accessible from the internet. Once located, verify if the authentication password is configured. If your deployment lacks this protection, restrict network access to the API immediately and coordinate with your platform team to apply the necessary updates or security configurations provided by the project maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.