CVE-2026-9911: OpenWidget Parser Heap UAF and the Week-One Defender Playbook

GreyTangle Labs disclosed CVE-2026-9911 on 2026-04-22 alongside a working RCE proof of concept against the reference Linux build. The bug is a heap use-after-free in OpenWidget’s XML widget configuration parser, reachable pre-auth at POST /api/v3/widget/preview. CVSS 4.0 is 8.6, the attack vector is fully remote with no user interaction, and roughly 14,200 instances were visible on Shodan the day after disclosure. OpenWidget also ships by default in Helmsman OS, BluePine Server, and the OpenWidget Appliance, which means a non-trivial number of operators have it installed without ever consciously deploying it. That is the failure mode that turns a clean vendor advisory into a months-long cleanup.

What actually breaks

The defect lives in parser/widget_xml.c. After parsing an incoming widget definition, OpenWidget performs a deep clone of the AST via widget_clone_subtree() before running validation. When validation hits a malformed XML attribute namespace, the parser triggers a rollback that recursively frees the parent subtree — but the clone routine never incremented refcounts on the cloned children. The next access to the cloned tree dereferences a freed widget_node_t*. A crafted XML payload makes the condition deterministic, and from there it is a fairly conventional heap-grooming path to control flow.

This is not a memory-safety curio. The endpoint is unauthenticated by design (it is meant to render preview thumbnails for anonymous dashboard visitors on some deployments), the trigger is a single HTTP POST, and the PoC already exists outside of the disclosing lab. Treat it as actively exploitable even though no in-the-wild activity has been reported as of disclosure.

This week, in order

Day zero — inventory. You cannot patch what you do not know you run. OpenWidget is bundled in at least three downstream distros, so a dpkg -l | grep -i widget or equivalent on every Linux estate is the first move, not the last. CM-8 (system component inventory) and SR-4 (provenance) are the relevant anchors. If your SBOM tooling is real, this is what you bought it for; query for openwidget between versions 3.0.0 and 3.2.1 inclusive.

Day zero — patch or block. Upgrade to 3.2.2, which the vendor released the same day as disclosure. If you cannot upgrade in the change window you have, block POST /api/v3/widget/preview at the reverse proxy. An NGINX snippet:

location = /api/v3/widget/preview {
    if ($request_method = POST) { return 403; }
}

Do not rely on WAF signatures matching the malformed namespace pattern. The trigger surface is the parser’s tolerance for malformed XML, which means signature evasion is cheap. Block the route.

Day one — rotate tokens. The vendor explicitly recommends rotating any API tokens issued through preview endpoints during the exposure window. If your deployment hands out scoped tokens via that path, treat every token issued since you first deployed an affected version as potentially compromised. IA-5 (authenticator management) covers the rotation hygiene; AC-2 covers the account review you should pair with it.

Day two — hunt. Pull reverse-proxy logs for POST /api/v3/widget/preview going back as far as you retain. You are looking for: unusual request bodies (oversized, deeply nested XML, non-printable bytes), repeat POSTs from the same source within seconds, and any 5xx responses that correlate with worker-process restarts. A heap UAF that fails to land cleanly tends to crash the worker before it succeeds. AU-6 (audit review) and SI-4 (system monitoring) are the control hooks; if your retention does not reach back to your earliest 3.0.0 deployment, document the gap as a residual risk now rather than during the next assessment.

Control mapping for the after-action

When you write this up for the ISSO — and you should, even if you patched cleanly — these are the families that matter:

If you carry a POA&M, the unpatched-instance entry should have a hard date, not a quarter. The exploit is a single POST.

The bundled-by-default problem

The distro-bundling note in the advisory is the part that will produce surprises three weeks from now. Operators who installed Helmsman OS or BluePine Server for unrelated reasons may be running a listening OpenWidget instance they never configured. The lesson is the boring one the SR family keeps making: distribution-level dependencies are part of your attack surface whether you adopted them deliberately or not. If your acquisition process (SA-12, SA-15) does not require a component-level review of bundled services on appliances and pre-built distros, this CVE is the artifact you take to the next governance review to argue that it should.

Bottom line

Patch to 3.2.2 today. If you cannot, block the preview endpoint at the proxy and rotate any tokens it issued. Hunt the logs even if your patch landed clean — the disclosure date is the date the PoC went public, not the date attacks started. And use the inventory exercise to find the OpenWidget instances you did not know you had.