+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHostingInfrastructure

CVE-2026-105474: SolusVM 2 SSTI Lets an Authenticated User Run Code on the Management Node - Floor 2.0.0-44739

By ServerGurus Team18 October 20265 min read
CVE-2026-105474: SolusVM 2 SSTI Lets an Authenticated User Run Code on the Management Node - Floor 2.0.0-44739

The Situation

WebPros SolusVM 2 is the current virt panel (management node + compute-resource agents), not the old SolusVM 1 master/slave stack. HackerOne published CVE-2026-105474 on 15 October 2026. CVE.org JSON is PUBLISHED, assigner hackerone, datePublished 2026-10-15T15:27:12.966Z. Description, theirs not ours: “A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.” CWE-1336. Credit: Georgii Shutiaev.[1][2][3]

HackerOne's CVSS 4.0 on NVD is 9.4 CRITICAL: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Privileges required: LOW. NVD vulnStatus this morning is Deferred; NIST has not published its own 3.1 score. CISA-ADP SSVC on the same object: exploitation none, automatable no, technical impact total (timestamp 2026-10-15T16:04:20Z).[2][3]

Vendor advisory (Zendesk, updated 2026-10-13T14:28:14Z): authenticated user, elevated privileges, full compromise of the management node, other customers on the same node at risk. Affected: all versions up to 2.0.0-44576. Patched version named: 2.0.0-44739. Call to action still says “or later, once released.”[1]

The release notes page does list Version 2.0.0-44739 dated 2026-10-13, last changelog line “Fixed important security issues. (SVM2-7568, SVM2-7575, SVM2-7577).” The previous tagged build is 2.0.0-44576 dated 2026-10-06. Treat 44739 as the floor from the changelog date; the advisory's “once released” line was not edited after the notes went up. The three SVM2 tickets are not mapped to this CVE on either page.[1][4]

CISA KEV catalog 2026.10.16 (count 1748, dateReleased 2026-10-16T17:15:48.8752Z) does not list CVE-2026-105474. Newest dateAdded rows are BeyondTrust CVE-2026-102764 and Fortinet CVE-2025-61624 - not a virt panel.[7]

What the bug actually is

SSTI (CWE-1336) means user-controlled text is interpreted by a server-side template engine instead of being treated as data. HackerOne/NVD stop at that class plus authenticated, remote, as root. The vendor stops at elevated privileges on the management node.[1][2][3]

What nobody published:

  • Which template engine (Twig, Blade, Smarty, Go text/template, …).
  • Which HTTP path, form field, or API attribute is the injection point.
  • Whether “authenticated user” is a client (tenant) account, a reseller, or an admin. CVSS PR:L is “low privileges,” not “unauthenticated.”
  • Whether “as root” is the management-node host, a Docker container UID 0, or a compute-resource agent. SolusVM 2's management node is a Docker stack; that distinction is unverified here.

Do not treat this as unauthenticated RCE. Do not treat this as a KVM guest-escape. The published claim is: someone who can log into SolusVM 2 can run code with elevated privileges on the management node, and the vendor says that can take other customers with it.[1][2]

We did not read SolusVM 2 source. There is no public PoC in the CVE references - only the vendor article.[2][3]

Hunt the fleet - version, then lock the panel

Inventory is the installer binary, not SolusVM 1's /usr/local/solusvm/:

# management node?
ls -l /usr/local/solus/bin/installer
test -f /usr/local/solus/config/config.yml && echo 'solusvm2 config present'

Vendor UI check: Settings → System Updates (docs also call it SolusVM 2 > System Updates). That page is where current version, channel (stable / mainline / testing), and “Install Now” live. Auto-updates are on by default, Saturday window unless you changed it. Updates apply sequentially - you cannot skip a build.[5][6]

Floor:

# SSH on the management node. Brief panel downtime while containers recycle.
# Compute resources and guest VMs: vendor says no downtime.
/usr/local/solus/bin/installer -update -to 2.0.0-44739

If 44739 is already behind stable/mainline, use the version System Updates shows as long as it is ≥ 2.0.0-44739. Do not revert past 44576 to “fix” an unrelated UI bug.[4][5][6]

Stuck on a failed update: vendor CLI path is the same installer; docs also document /usr/local/solus/bin/installer -revert -to <previous> after a backup. Take a management-node backup (Backups → Management Node Backups, or your own) before a security bump. We did not run the installer.[5]

Until the floor is on disk:

  • Restrict TCP 443 (and anything else that serves the panel) to operator IPs. Tenant self-service is the risk if PR:L means a client login.
  • Disable unused client/reseller logins. Rotate panel credentials. Turn on whatever MFA the install actually has - we did not inventory SolusVM 2 MFA options for this post.
  • A WAF is not a version bump. There is no virtual patch named in the advisory.[1]

After 44739: this patch does not rewind a management node that was already owned. Look for unexpected admin users, unexpected API tokens, unexpected compute-resource adds, and installer/update logs around 7-15 October 2026. We have no IOC list from the vendor.[1][2]

Honesty / What We Could Not Verify

  • We did not exploit this. No template payload, no login, no installer run.
  • “as root” is HackerOne/CVE.org, not the vendor sentence. Vendor: “elevated privileges” / “unauthorized commands” / “full compromise of the management node.” Unverified whether that is host root or container root.[1][2][3]
  • Role of the authenticated user is unpublished. PR:L only. A stolen client password and a stolen admin password are different incidents; the CVE text does not split them.[2][3]
  • Template engine and sink are unpublished. Mechanism analysis above is the CWE, not a code review.
  • Three SVM2 tickets on the 44739 notes. None is labelled CVE-2026-105474. 44739 may include more than this bug.[4]
  • Vendor CTA still says “once released” on the article we pulled (updated_at 2026-10-13T14:28:14Z) even though the changelog dates 44739 the same day. We are using the changelog as evidence the build exists, not assuming the Zendesk line was edited.[1][4]
  • Not on CISA KEV as of catalog 2026.10.16 / count 1748.[7]
  • CISA-ADP SSVC: exploitation none. We are not inventing in-the-wild use.[2]
  • SolusVM 1 is out of scope. Different paths, different product. Do not run SolusVM 1 upcp-style folklore against this CVE.
  • NVD status Deferred - no NIST 3.1 yet. The 9.4 is HackerOne CVSS 4.0.[2]

What this is not

  • Not CVE-2026-43641 (Virtualizor billing-hook unauth root). Different panel.
  • Not CVE-2026-68492 (Plesk REST API authenticated root).
  • Not CVE-2026-104798 (My Calendar call_user_func). WordPress, not virt.
  • Not today's KEV (BeyondTrust Remote Support, Fortinet path traversal).
  • Not “every SolusVM 2 cluster is owned.” Need a login and ≤ 2.0.0-44576.
  • Not a guest VM kernel bug. Guests stay up during the management-node update, per vendor docs.[5]

Sources

[1] https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2 - SolusVM vendor advisory CVE-2026-105474 [2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-105474 - NVD REST CVE-2026-105474 [3] https://cveawg.mitre.org/api/cve/CVE-2026-105474 - CVE.org JSON CVE-2026-105474 [4] https://docs.solusvm.com/en/release-notes/ - SolusVM 2 release notes 2.0.0-44739 [5] https://docs.solusvm.com/en/solusvm2/administrator-guide/solusvm-2-0-updates/ - SolusVM 2 updates admin guide [6] https://support.solusvm.com/hc/en-us/articles/13266446486039-How-to-update-SolusVM-2 - How to update SolusVM 2 [7] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON catalog 2026.10.16

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales