CVE-2026-116779, FreeSWITCH 1.11.2 and earlier: one inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands, the vendor says exploitation has been observed, and 1.11.3 fixes it (CVSS 3.1 9.8)

SignalWire's advisory GHSA-mg63-h38w-8p9p describes CVE-2026-116779: FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on + and treats the left half as a chat proto name, the mod_dptools module registers an api chat interface that hands its address to switch_api_execute(), and a peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs (SignalWire, 2026-10-28). The impact is command execution with the privileges of the FreeSWITCH process, including arbitrary operating-system commands, disclosure of configuration and credentials and full call control, and where mod_lua is loaded, as the stock configuration does, inline Lua is a second route (SignalWire, 2026-10-28). The advisory scores it CVSS 3.1 9.8, lists 1.11.2 and earlier as affected and 1.11.3 as patched, and states that exploitation of this path has been observed in the wild without naming an actor or a victim (SignalWire, 2026-10-28). BSI CERT-Bund rated its advisory on the flaw critical and lists versions before 1.11.3 as affected (BSI CERT-Bund, 2026-11-05).

The default posture is exposed: chat handling is on unless a profile sets enable-chat=false, the stock vanilla configuration leaves it on for the internal and external profiles, and the inbound ACL does not cover MESSAGE; where MESSAGE authentication is enforced (the default from 1.10.7) any one account on the profile is enough, and installations that still carry the sample directory user default, which has no password, need no account of their own (SignalWire, 2026-10-28). The fix is a per-profile enable-chat-api-proto parameter that is off unless set, so the route is closed by default and a MESSAGE that selects the proto is answered with 403 and logged with the source and the requested command (SignalWire, 2026-10-28). auth-messages alone does not close the path, and disable_system_api_commands=true removes the system API but leaves the route to every other registered API, module loading and call origination included (SignalWire, 2026-10-28).