PT-2026-21278 · Unknown · Openitcockpit

H00Die-Gr3Y · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-24891

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions 5.3.1 and below

Description openITCOCKPIT, an open source monitoring tool, has an unsafe deserialization issue in the Gearman worker implementation. The oitc gearman function uses PHP’s unserialize() on job payloads without proper restrictions or validation. This allows an attacker to potentially trigger PHP Object Injection if they can submit crafted serialized payloads to the Gearman service, especially when Gearman listens on non-local interfaces or network access to TCP/4730 is unrestricted. The issue persists regardless of deployment configuration, as the trust boundary is not enforced in the application code.

Recommendations Upgrade to version 5.4.0 or later.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-24891

GHSA-X4MQ-8GFG-FRC4

Produtos afetados

Openitcockpit

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24891.json · Exploit
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-x4mq-8gfg-frc4 · Aviso do Fabricante
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-24891 · Aviso do Fabricante
• https://t.me/CVEtracker/45299 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2024988773860384772 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24891 · Nota de Segurança