PT-2026-21297 · Nagios+2 · Nagios+3

H00Die-Gr3Y · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2026-24892

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT Community Edition versions prior to 5.3.1

Description openITCOCKPIT is a monitoring tool compatible with Nagios, Naemon, and Prometheus. The software contains an unsafe PHP deserialization pattern when handling changelog entries. Specifically, serialized changelog data originating from attacker-controlled application state is deserialized without class restrictions. While no current application endpoint directly introduces PHP objects into this data path, the unrestricted use of unserialize() creates a potential PHP object injection issue. Future modifications, plugins, or refactoring that introduce object values into this path could lead to immediate exploitability, potentially resulting in remote code execution.

Recommendations Update to a version newer than 5.3.1.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-24892

GHSA-G83P-VVJM-G39X

Produtos afetados

Naemon

Nagios

Prometheus

Openitcockpit Community Edition

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24892.json · Exploit
• https://github.com/openITCOCKPIT/openITCOCKPIT/commit/975e0d0dfb79898568afbbfdba8f647d92612a69 · Correção
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-g83p-vvjm-g39x · Aviso do Fabricante
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0 · Nota
• https://twitter.com/CVEnew/status/2024988759423680681 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24892 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24892 · Nota de Segurança