Is CVE-2026-32729 actively exploited?

No active exploitation of CVE-2026-32729 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32729 be exploited remotely?

Yes. CVE-2026-32729 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32729?

CVE-2026-32729 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2026-32729

HIGH

CVE-2026-32729

CWE-307Published: March 16, 2026· Updated: Mar 17, 2026

8.8

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:18.5th

Official Description

Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user's valid credentials (via phishing, credential stuffing, or data breach) can brute-force the 6-digit TOTP code to completely bypass two-factor authentication. The TOTP verification session persists for 24 hours (default cache TTL), providing an excessive window during which the full 1,000,000-code keyspace (000000–999999) can be exhausted. At practical request rates (~500 req/s), the attack completes in approximately 33 minutes in the worst case. This vulnerability is fixed in 4.8.1.

NVD Source

Technical Analysis

CVE-2026-32729 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.