CVE-2026-24893

openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2	Product Release Notes
https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2	Mitigation Vendor Advisory
https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2	Press/Media Coverage Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-14 21:16

Updated : 2026-07-25 11:10

NVD link : CVE-2026-24893

Mitre link : CVE-2026-24893

CVE.ORG link : CVE-2026-24893

JSON object : View

Products Affected

it-novum

openitcockpit

CWE

CWE-20

Improper Input Validation

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-24893", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24893", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T13:40:22.140339Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "openITCOCKPIT", "product": "openITCOCKPIT", "versions": [{"status": "affected", "version": "< 5.5.2"}]}]}], "published": "2026-04-14T21:16:24.987", "references": [{"url": "https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2", "tags": ["Press/Media Coverage", "Release Notes"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue."}, {"lang": "es", "value": "openITCOCKPIT es una herramienta de monitorizaci\u00f3n de c\u00f3digo abierto dise\u00f1ada para diferentes motores de monitorizaci\u00f3n. openITCOCKPIT Community Edition anterior a la versi\u00f3n 5.5.2 contiene una vulnerabilidad de inyecci\u00f3n de comandos que permite a un usuario autenticado con permiso para a\u00f1adir o modificar hosts ejecutar comandos arbitrarios del sistema operativo en el backend de monitorizaci\u00f3n. La vulnerabilidad surge porque los atributos de host controlados por el usuario (espec\u00edficamente la direcci\u00f3n del host) se expanden en plantillas de comandos de monitorizaci\u00f3n sin validaci\u00f3n, escape o entrecomillado. Estas plantillas son posteriormente ejecutadas por el motor de monitorizaci\u00f3n (Nagios/Icinga) a trav\u00e9s de un shell, lo que resulta en ejecuci\u00f3n remota de c\u00f3digo. La versi\u00f3n 5.5.2 corrige el problema."}], "lastModified": "2026-07-25T11:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:it-novum:openitcockpit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59D6662E-E1EB-49A8-8B31-A15DBA895263", "versionEndExcluding": "5.5.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}