CVE-2026-24891
HighSummary
openITCOCKPIT to narzędzie do monitorowania typu open source, które w wersjach 5.3.1 i poniżej zawiera niebezpieczną deserializację w implementacji pracownika Gearman. Funkcja pracownika, zarejestrowana jako oitc_gearman, wywołuje PHP's unserialize() na ładunkach zadań bez wymuszania ograniczeń klasowych lub weryfikacji pochodzenia danych.
Risk Assessment
W środowiskach, gdzie usługa Gearman lub pracownik są wystawione na niezaufane systemy, atakujący może przesłać spreparowane ładunki, co prowadzi do wstrzyknięcia obiektów PHP w procesie pracownika. To stwarza ryzyko dla organizacji, zwłaszcza gdy dostęp do portu TCP/4730 jest nieograniczony.
Recommendation
Zaleca się ograniczenie dostępu do usługi Gearman tylko do zaufanych systemów oraz wprowadzenie odpowiednich zabezpieczeń w kodzie aplikacji, aby wymusić weryfikację pochodzenia danych przed ich deserializacją.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
Local privilege escalation due to insecure file permissions. Affects Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin in versions older than the specified builds.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in cod