PT-2026-32910 · Unknown · Openitcockpit Community Edition

H00Die-Gr3Y · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-24893

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openITCOCKPIT Community Edition versions prior to 5.5.2

Description An authenticated user with permissions to add or modify hosts can execute arbitrary OS commands on the monitoring backend. This occurs because user-controlled host attributes, specifically the host address, are expanded into monitoring command templates without proper validation, escaping, or quoting. These templates are subsequently executed by the monitoring engine (Nagios/Icinga) via a shell, leading to remote code execution.

Recommendations Update to version 5.5.2.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

CVE-2026-24893

Affected Products

Openitcockpit Community Edition

References · 5

• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24893 · Security Note
• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2 · Note
• https://twitter.com/CVEnew/status/2044338935112118470 · Twitter Post
• https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2 · Note