CVE-2026-45721
Algernon is a small Go web server that had a flaw allowing unauthenticated remote code execution. Prior to version 1.17.7, the server could execute a Lua script named handler.lua found in any parent directory of the server root. The issue is fixed in 1.17.7.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Algernon web server versions earlier than 1.17.7.
Real-world impact
An attacker who can write a handler.lua file in a directory above the server root can run arbitrary code on the server without needing to authenticate, potentially taking full control of the machine.
Why this severity
The CVSS score of 9 reflects the high impact of remote code execution (confidentiality, integrity, availability all high), the lack of authentication required, and the complexity of the attack being high but still achievable by an attacker with network access.
What to do about it
- 01Upgrade Algernon to version 1.17.7 or later.
- 02Restart the web server to apply the update.
NVD-referenced vendor advisory
Timeline
- May 26, 2026 · May 26, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.