Ajenti vulnerabilities
We track 3 vulnerabilities in Ajenti products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Ajenti vulnerabilities
- 9.9 Critical severity
ajenti: Missing Authorization
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. I
- 7.5 High severity
ajenti: Improper Authentication
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
- 9.8 Critical severity
ajenti: Improper Access Control
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.