CVE-2026-40611 - Vulnerability Analysis

Overview

Lego < 4.34.0 contains a path traversal vulnerability in the webroot HTTP-01 challenge provider caused by improper validation of challenge tokens, letting a malicious ACME server write or delete arbitrary files, exploit requires interaction with a malicious ACME server.

Severity & Score

Impact

A malicious ACME server can write or delete arbitrary files with the privileges of the Lego process, potentially leading to system compromise.

Mitigation

Upgrade to version 4.34.0 or later.

References

• https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 21, 2026

🟠 CVE-2026-40611 - High (8.8) Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challen... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40611/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner