PT-2026-32910 · Unknown · Openitcockpit Community Edition

H00Die-Gr3Y · CVE-2026-24893 · Published 2026-04-14 · Updated 2026-04-15

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT Community Edition versions prior to 5.5.2

Description An authenticated user with permissions to add or modify hosts can execute arbitrary OS commands on the monitoring backend. This occurs because user-controlled host attributes, specifically the host address, are expanded into monitoring command templates without proper validation, escaping, or quoting. These templates are subsequently executed by the monitoring engine (Nagios/Icinga) via a shell, leading to remote code execution.

Recommendations Update to version 5.5.2.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2026-24893

GHSA-789Q-PW85-J2Q2

Affected Products

Openitcockpit Community Edition

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24893.json · Exploit
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24893 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24893 · Vendor Advisory
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2 · Note
• https://twitter.com/CVEnew/status/2044338935112118470 · Twitter Post
• https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2 · Note