Version 6.2.0 of the Passenger application server has been released. This release addresses several NGINX vulnerabilities for deployments utilizing the bundled NGINX server (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) and one in Passenger itself with a pending CVE number. Additionally this release improves compatibility with FreeBSD.
Passenger Vulnerability
We have seen exploitation of this vulnerability in the wild at a shared hosting provider. Please upgrade as soon as possible, especially users that run Passenger as root and allow untrusted users to run arbitrary processes (i.e. multi-tenant deployments) are susceptible to attack.
If you do not run Passenger as root and your systems do not allow untrusted users to run arbitrary code then this vulnerability is not an immediate threat but it is still recommended you upgrade as soon as possible.
Breaking Changes
This change only affects two commands:
passenger-config reopen-logs
passenger-config api-call -a watchdog_api ...
If you invoke these as root or as the Passenger app-owning user (the standard path, e.g. via the logrotate integration Passenger ships, which already runs as root), nothing changes. These users can read the automatically-generated admin credentials and always authenticated correctly; the fix has no visible effect.
If you invoke these as some other, unprivileged user, behavior changes. The same call now correctly fails with:
*** ERROR: You are not authorized to perform this particular administration command on this Phusion Passenger instance. Please try again with 'sudo ...'.If you have custom tooling (log rotation scripts, cron jobs, deploy hooks) that calls these commands as a non-root, non-app-owning user, you'll need to run it as root/the app owner instead, or grant that user explicit access via --authorize / watchdog_api_server_authorizations.
Workaround for Passenger vulnerability
If you are unable to upgrade to Passenger 6.2.0 and you are on a Passenger version of 5.2.0 and you are running Passenger as the root user then it is strongly recommended you apply the following workaround.
This workaround assumes Passenger (and its web server, Apache/Nginx) runs as root, and that any passenger-config/passenger-status commands you rely on are also invoked as root (e.g. via sudo, or a root cron job / logrotate hook). It does not attempt to preserve non-root CLI access.
- Create a dedicated password file
mkdir -p /etc/apache2/conf.d/passenger
touch /etc/apache2/conf.d/passenger/myuser.txt
chmod 600 /etc/apache2/conf.d/passenger/myuser.txt
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32 > /etc/apache2/conf.d/passenger/myuser.txt22. Configure the Watchdog to require it
Add to /etc/apache2/conf.d/passenger.conf (Nginx: use passenger_ctl instead of PassengerCtl)
PassengerCtl watchdog_api_server_authorizations '["readonly:myuser:/etc/apache2/conf.d/passenger/myuser.txt"]'
3. Reload
systemctl reload httpd.service
systemctl status httpd.serviceConsequences
Anything invoking passenger-config as a non-root user — which is how most people would actually run it interactively or from app-level scripts — breaks, permanently, with this workaround.
Installing 6.2.0
Please see the installation guide for advice on getting started with Passenger. Coming from a language other than Ruby, Python, Meteor or Node? Even if we didn't write a specific tutorial for your language, we made a generic guide that shows you the steps.
Upgrading to 6.2.0
We strongly advise staying up to date with the latest version.
Check out our upgrade guides for the different platforms:
Please be aware that you can enjoy enterprise features and sponsor the open source development directly by buying Phusion Passenger Enterprise.
Star