PT-2026-21278 · Unknown · Openitcockpit

H00Die-Gr3Y · Published 2026-02-20 · Updated 2026-02-20 · CVE-2026-24891

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions 5.3.1 and below

Description openITCOCKPIT, an open source monitoring tool, has an unsafe deserialization issue in the Gearman worker implementation. The oitc gearman function uses PHP’s unserialize() on job payloads without proper restrictions or validation. This allows an attacker to potentially trigger PHP Object Injection if they can submit crafted serialized payloads to the Gearman service, especially when Gearman listens on non-local interfaces or network access to TCP/4730 is unrestricted. The issue persists regardless of deployment configuration, as the trust boundary is not enforced in the application code.

Recommendations Upgrade to version 5.4.0 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-24891

GHSA-X4MQ-8GFG-FRC4

Affected Products

Openitcockpit

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24891.json · Exploit
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-x4mq-8gfg-frc4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24891 · Security Note
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0 · Note
• https://t.me/CVEtracker/45299 · Telegram Post
• https://twitter.com/CVEnew/status/2024988773860384772 · Twitter Post