What is the CVSS score of CVE-2026-24891?

CVE-2026-24891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-24891?

openITCOCKPIT monitoring deployments running version 5.3.1 or below are vulnerable to remote code execution through unsafe deserialization in the Gearman worker component.

Is there a public PoC exploit available for CVE-2026-24891?

Yes, a public proof-of-concept exploit is available for CVE-2026-24891. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-24891?

Within 24 hours: Inventory all openITCOCKPIT deployments and identify version numbers; isolate affected instances from production networks if possible; disable Gearman worker functionality if not critical to operations. Within 7 days: Implement network segmentation to restrict Gearman worker access to trusted internal IPs only; enable enhanced logging and monitoring for deserialization attempts; prepare incident response procedures. Within 30 days: Monitor vendor security advisories for patch availability; evaluate alternative monitoring solutions; conduct security assessment of any potentially compromised systems.

PHP CVE-2026-24891

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-02-20 security-advisories@github.com

PHP Prometheus Deserialization Openitcockpit

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 24, 2026 - 19:22 vuln.today

Public exploit code

CVE Published

Feb 20, 2026 - 18:25 nvd

HIGH 7.5

DescriptionGitHub Advisory

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in version 5.4.0.

AnalysisAI

Remote code execution in openITCOCKPIT 5.3.1 and earlier via unsafe deserialization in the Gearman worker component, which calls unserialize() on untrusted job payloads without validation or class restrictions. Attackers can exploit this by submitting crafted serialized objects to trigger PHP Object Injection when Gearman is exposed to untrusted networks. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects the environments where the Gearman component of Openitcockpit. openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not en