CVE-2026-24893 - Vulnerability Analysis

Overview

openITCOCKPIT Community Edition < 5.5.2 contains a command injection caused by unvalidated expansion of user-controlled host attributes in monitoring command templates, letting authenticated users with host modification permissions execute arbitrary OS commands.

Severity & Score

Impact

Authenticated users with host modification permissions can execute arbitrary OS commands on the monitoring backend, leading to full system compromise.

Mitigation

Upgrade to version 5.5.2 or later.

References

• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2
• https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner