CVE-2026-27179 is an unauthenticated SQL injection (CVSS 8.2) in the commands module of MajorDoMo, the home automation platform. Admin passwords are stored as unsalted MD5 hashes, so successful use can lead to admin access. A fix pull request is listed, so update from the project and keep it off the internet.
What's affected
MajorDoMo (Major Domestic Module). The commands_search.inc.php file puts the parent request parameter into several SQL queries without sanitization. The module can be loaded without authentication through the /objects/ endpoint.
The VulnCheck advisory lists no fixed release number. A fix is available as pull request 1177 in the project repository, so check that it is merged into the version you run.
How to check if you're exposed
Check whether your MajorDoMo is reachable from outside your home or office network, and which commit or version you run compared with the fix in pull request 1177. Review web server logs for requests to the objects module with the commands module and unusual values.
If the system was exposed, assume stored credentials may be at risk.
What to do now
- Update MajorDoMo to a build that includes the fix from pull request 1177.
- Remove it from direct internet exposure, and use a VPN for remote access.
- Change the admin password and any shared passwords after updating.
- Review users and settings for changes you did not make.
- Back up the database before and after updating.
Why it matters
The record lists CWE-89, SQL injection. Input was placed straight into queries, and an unauthenticated route let anyone reach that code. The advisory notes that time based techniques work, which means a database can be read without any visible error.
Unsalted MD5 password storage makes the result worse, since recovered hashes are cheap to crack. The record does not mark this CVE as known exploited.
Quick check
Why does MD5 storage matter here?
If an attacker reads the users table, unsalted MD5 hashes are quick to crack, so database access can become admin access.
Sources
- CVE-2026-27179 on Gold
- VulnCheck advisory, fetched: https://www.vulncheck.com/advisories/majordomo-unauthenticated-sql-injection-in-commands-module
- Fix pull request listed in the record: https://github.com/sergejey/majordomo/pull/1177
Last reviewed: 19 October 2026.
