CVE-2026-26422: Local Privilege Escalation in Clash Verge Rev IPC via Insecure Permissions and Hardcoded Credentials

Vulnerability Overview CVE-2026-26422: Local Privilege Escalation (LPE) in Clash Service IPC Vulnerability Description: A local privilege escalation (LPE) vulnerability exists in the Clash Service IPC service, caused by insecure file permissions and hardcoded credentials. An attacker can exploit this to obtain full root access. Vulnerability Types: - CWE-732: Improper Permission Assignment for Critical Resource - CWE-798: Use of Hard-coded Credentials Affected Scope Affected Products: - Ecosystem: Clash Verge Rev and its downstream versions, including the component - Package Names: , - Affected Versions: , - Fixed Versions: , Severity: - CVSS 9.4 - Critical (Initial) - CVSS 8.4 - High (Official) Remediation Mitigation Measures: - Elimination of Race Conditions: Removal of the unsafe 125ms asynchronous followed by manual . - Native Defense: Introduction of a preemptive hook to set the permission mask before process startup, providing cross-platform defense against unauthorized write access. Fix Code: Proof of Concept (PoC) Vulnerability Timeline 2025-12-25: Discovery and Proof of Concept (PoC) 2025-12-25 - 12-28: Disclosure 2025-12-31: Fix 2026-01-08: End of Life 2026-02-27: CVE Assignment 2026-03-10: Public Disclosure 2026-06-07: Official Release Background and System Architecture Permission Isolation: IPC Service and Mihomo Kernel Vulnerability Anatomy: Exploitation Chain Attack Path Visualization Proof of Concept: Local Privilege Escalation Disaster Remediation: Collaborative Construction of Robust Unix Standards Final Reflections Beyond Patching --- The above is a summary of key information regarding the CVE-2026-26422 vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-26422: Local Privilege Escalation in Clash Verge Rev IPC via Insecure Permissions and Hardcoded Credentials