CVE-2026-38979: Ajenti Clickjacking Vulnerability in Login & Admin UI

Technical summary

CVE-2026-38979 is a clickjacking vulnerability (CWE-1021) in Ajenti through version 2.2.13. The HTTP response handler in ajenti-core/aj/http.py constructs responses without implementing anti-framing headers. Specifically, the response initialization accepts handler-provided headers and passes them directly to WSGI start_response() without enforcing X-Frame-Options or Content-Security-Policy frame-ancestors directives. This allows malicious websites to embed Ajenti login and admin pages in iframes, enabling UI redressing attacks where user actions are intercepted or misdirected.

Business impact

An attacker could lure Ajenti administrators or users to a malicious website and, through transparent or disguised iframes, trick them into performing unintended administrative actions—such as creating accounts, modifying system settings, or changing access controls. If login credentials are inadvertently entered into a framed login form, attackers may obtain authentication tokens. The impact is limited to users who interact with both the malicious site and Ajenti within the same session, but the attack requires only social engineering and network access, making it a practical threat in multi-tenant or public-access scenarios.

Affected systems

All Ajenti installations through version 2.2.13 are affected. The vulnerability resides in the core HTTP handling layer, affecting both the login interface and administrative UI regardless of deployment architecture or configuration. Any user or administrator accessing Ajenti via a web browser is potentially at risk if they simultaneously visit an attacker-controlled webpage.

Exploitability

Exploitation requires user interaction (the CVSS attack vector reflects this with UI:R). An attacker must craft a webpage embedding Ajenti in an iframe, then socially engineer a target into visiting that page while authenticated to or actively using Ajenti. The attack is not waived by authentication or special privileges—the framing happens at the HTTP layer before authentication checks. CVSS score of 5.4 (MEDIUM) reflects low attack complexity but the necessity of user involvement and limited impact scope (no server compromise, no data exfiltration, only limited integrity and confidentiality impact from UI manipulation).

Remediation

Upgrade Ajenti to a patched version that adds X-Frame-Options: DENY (or SAMEORIGIN if iframing is intentional) and/or Content-Security-Policy headers with frame-ancestors 'none' (or 'self'). Verify the patch version against the official Ajenti project release notes or security advisory. As a temporary mitigating measure, administrators can deploy a reverse proxy (nginx, Apache) to inject these headers before responses reach end users, though this is not a substitute for fixing the source code.

Patch guidance

Check the official Ajenti repository and release history for versions after 2.2.13 that include anti-framing headers. Apply the patch during a maintenance window; clickjacking fixes typically do not require configuration changes or data migration. Test the patch by confirming that X-Frame-Options or CSP frame-ancestors headers are present in HTTP responses from the Ajenti login and admin interfaces. If a patched version is not yet available, contact the Ajenti maintainers or consider implementing header injection via a reverse proxy as an interim control.

Detection guidance

Monitor HTTP responses from your Ajenti instance for the presence (or absence) of X-Frame-Options and Content-Security-Policy headers. Use browser developer tools (Network tab) to inspect response headers when accessing the login page. For continuous monitoring, configure your reverse proxy or WAF to log instances where these headers are missing. Alert on any unauthorized iframe embedding attempts in application logs or via third-party iframe detection scripts. Additionally, review user access logs for sessions initiated from suspicious referrer origins.

Why prioritize this

This vulnerability is rated MEDIUM severity and is not yet on the CISA Known Exploited Vulnerabilities list, suggesting limited real-world exploitation to date. However, clickjacking attacks are well-understood and trivial to execute; the barrier is primarily social engineering rather than technical sophistication. Organizations running Ajenti in production, particularly in user-facing or multi-tenant environments, should prioritize patching. The fix is typically low-risk and non-disruptive, making it a good candidate for rapid deployment once patches are available.

Risk score, explained

The CVSS 3.1 score of 5.4 is driven by: Attack Vector Network (AV:N) — the attack occurs over HTTP; Attack Complexity Low (AC:L) — no special conditions are required; Privileges Required None (PR:N) — the attacker does not need credentials; User Interaction Required (UI:R) — the victim must interact with the framed UI; Scope Unchanged (S:U) — only the Ajenti application is affected; Confidentiality Impact Low (C:L) — credentials or session tokens may be exposed; Integrity Impact Low (I:L) — administrative actions may be unwittingly performed; Availability Impact None (A:N) — the service itself is not disrupted. The MEDIUM rating reflects that while the attack is easy to mount and practical, the impact per-incident is limited and depends on the target's concurrent access to both the malicious site and Ajenti.

Frequently asked questions