CVE-2009-2936: Varnish CLI lacks authentication, allowing remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw allows unauthenticated remote code execution and service control with a high EPSS score, though the vendor dispute and lack of KEV listing add uncertainty.

What it is

The Varnish reverse proxy master process exposes its Command Line Interface over a TCP port without requiring authentication for received commands. An attacker who can reach that port can issue directives such as vcl.inline with inline C code, param.set, stop, start, and vcl.load. The vendor disputes the report, calling it fundamentally misguided and pointless, so the practical risk depends on whether the CLI port is exposed.

Impact

An attacker gains the ability to execute arbitrary code in the Varnish master process, change process ownership, stop or start the service, and read the first line of arbitrary files. This can lead to full compromise of the proxy host and disruption of the caching service.

Attack surface

Reachable over the network via TCP to the Varnish CLI port, with no authentication required per the description and the AV:N/AC:L/Au:N vector. No user interaction is needed for the direct command-execution paths; the CSRF path requires a victim on a trusted network to be induced to send a request.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.63824 (99.183 percentile), but the reference tags are empty and provide no exploit-availability signal.

What to do

• Upgrade Varnish to 2.1.0 or later, which is the version boundary given in the description.
• Bind the CLI management interface to localhost or a dedicated management network and never expose it to untrusted networks.
• Restrict TCP access to the CLI port with host firewall rules or network ACLs, allowing only trusted administration hosts.
• Where the CLI must be remote, place it behind authenticated access controls or a management jump host.
• Review Varnish CLI configuration and deployment to confirm the management port is not reachable from general user networks.

Detection

• Monitor network connections to the Varnish CLI TCP port from unexpected or external source addresses.
• Alert on CLI directives such as vcl.inline, vcl.load, param.set, stop, and start appearing in logs or process activity from non-administrative sources.
• Audit Varnish master process ownership and configuration changes for unexplained modifications.
• Review host and network logs for file-read attempts or service restarts correlated with CLI port access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.