« Volver al listado

CVE-2026-24891

Estado: AnalizadaAlta (7.5)—

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code.

Leer descripción completaMostrar menos

In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in version 5.4.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso a red adyacente (TCP/4730 Gearman sin restricciones) con PR:L requiere T1210. PHP unserialize() sin validación permite inyección de objetos para ejecución de código (T1059) o escalada local (T1068).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

It-novum — Openitcockpit

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-24891",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24891",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-20T18:41:20.604345Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "openITCOCKPIT",
          "product": "openITCOCKPIT",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.4.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-20T18:25:51.143",
  "references": [
    {
      "url": "https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-x4mq-8gfg-frc4",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in version 5.4.0."
    },
    {
      "lang": "es",
      "value": "openITCOCKPIT es una herramienta de monitorización de código abierto diseñada para diferentes motores de monitorización como Nagios, Naemon y Prometheus. Las versiones 5.3.1 e inferiores contienen un sumidero de deserialización insegura en la implementación del worker de Gearman. La función worker registrada como oitc_gearman llama a unserialize() de PHP en las cargas útiles de los trabajos sin aplicar restricciones de clase ni validar el origen de los datos. Aunque el despliegue previsto asume que solo los componentes internos de confianza encolan trabajos de Gearman, este límite de confianza no se aplica en el código de la aplicación. En entornos donde el servicio o worker de Gearman está expuesto a sistemas no confiables, un atacante puede enviar cargas útiles serializadas maliciosas para desencadenar una inyección de objetos PHP en el proceso del worker. Esta vulnerabilidad es explotable cuando Gearman escucha en interfaces no locales, el acceso a la red a TCP/4730 no está restringido, o los sistemas no confiables pueden encolar trabajos. Los despliegues predeterminados y correctamente reforzados pueden no ser inmediatamente explotables, pero el sumidero inseguro permanece presente en el código independientemente de la configuración del despliegue. Aplicar este límite de confianza en el código reduciría significativamente el riesgo y evitaría la explotación en entornos mal configurados. Este problema ha sido corregido en la versión 5.4.0."
    }
  ],
  "lastModified": "2026-06-17T10:23:45.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1602A3F-8FC6-43BE-948E-BE5E574DEDF9",
              "versionEndExcluding": "5.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}