CVE-2026-14453
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.
Risk Assessment
Risk includes disclosure of environment secrets and potential impact on the availability of the Centreon Infra Monitoring product, potentially leading to system compromise and data leakage.
Recommendation
Immediately update the centreon-open-tickets module to the latest patched version and enable Smarty security policy to prevent template injection.
Other vulnerabilities in Centreon
See all- CVE-2026-11587High
Centreon contains an SQL injection vulnerability that allows an authenticated user with access to ACL management to read and modify the Centreon database. The flaw enables manipulation of database data beyond the user's intended permissions.
- CVE-2021-27676Medium
Centreon version 20.10.2 is affected by a stored XSS vulnerability. The dep_description and dep_name parameters are vulnerable to script injection, requiring login and navigation to Configuration > Notifications > Hosts.
Original NVD description (English source)
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS