OpenRGB root daemon allows trivial remote compromise

OpenRGB, the cross-platform suite for controlling RGB LED hardware, ships a network server that can be fully compromised remotely when left in its default configuration, according to a report from Matthias Gerstner published on oss-security.

The OpenRGB server listens on all interfaces on TCP port 6742 and, in packaging such as openSUSE Tumbleweed’s systemd unit, runs with full root privileges. Gerstner’s review of the custom protocol found high-severity flaws that make remote system compromise straightforward. Upstream’s 1.0rc3-hotfix release addresses the worst of the problems.

Three CVEs cover the issues: CVE-2026-59682, CVE-2026-59683, and CVE-2026-18794. In plain terms, untrusted clients talking to the default server can cross from lighting control into complete host takeover because the daemon both binds widely and holds excessive privilege.

A draft of the findings went to the distros list on August 11, with general publication on August 25. Operators running OpenRGB in server mode should treat exposure of port 6742 as critical until they are on a fixed build, and should not run the service as root or on untrusted networks.