What is the CVSS score of CVE-2026-24893?

CVE-2026-24893 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Openitcockpit are affected by CVE-2026-24893?

openITCOCKPIT Community Edition versions before 5.5.2 contain a remote code execution vulnerability allowing authenticated users with host management permissions to execute arbitrary commands on…. A patch is available.

How to fix or mitigate CVE-2026-24893?

Within 24 hours: Inventory all openITCOCKPIT Community Edition deployments and identify instances running versions prior to 5.5.2. Within 7 days: Apply vendor-released patch to upgrade all affected instances to version 5.5.2 or later, testing in non-production environments first. Within 30 days: Conduct access review of host management permissions to restrict this role to necessary personnel only; implement network segmentation limiting host management access to trusted administrative networks.

Openitcockpit CVE-2026-24893

EUVD-2026-22703 HIGH

Improper Input Validation (CWE-20)

2026-04-14 GitHub_M

Command Injection RCE Openitcockpit

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 28, 2026 - 17:21 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.5.2

Analysis Generated

Apr 14, 2026 - 22:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 21:16 euvd

EUVD-2026-22703

Analysis Generated

Apr 14, 2026 - 21:16 vuln.today

CVE Published

Apr 14, 2026 - 20:37 nvd

HIGH 8.8

DescriptionGitHub Advisory

openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.

AnalysisAI

Remote code execution in openITCOCKPIT Community Edition (versions prior to 5.5.2) allows authenticated users with host management permissions to execute arbitrary OS commands on the monitoring backend via command injection in host address fields. The vulnerability stems from unsanitized user input being expanded into Nagios/Icinga monitoring command templates and executed via shell, enabling full system compromise. CVSS score of 8.8 reflects network-accessible attack with low complexity requiring only low-privilege authentication. No public exploit identified at time of analysis, with EPSS data unavailable for this recently disclosed CVE.

Technical ContextAI

This vulnerability affects openITCOCKPIT, a web-based monitoring platform that interfaces with backend monitoring engines like Nagios and Icinga. The flaw (CWE-20: Improper Input Validation) occurs in the host configuration workflow where user-supplied host attributes-particularly the host address field-are incorporated into monitoring command templates without proper validation, escaping, or shell-safe quoting. When the monitoring engine executes these commands via a shell interpreter to perform health checks, the injected commands run with the privileges of the monitoring backend process. This represents a classic template injection scenario where the separation between data (host configuration) and code (monitoring commands) is violated, allowing authenticated users to break out of their intended privilege boundary and achieve remote code execution on the infrastructure monitoring system.

RemediationAI

Vendor-released patch: openITCOCKPIT version 5.5.2 fully remediates this vulnerability by implementing proper input validation, escaping, and quoting for host attributes used in command templates. Organizations should immediately upgrade to version 5.5.2 or later, available at https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2. Detailed upgrade guidance and release notes are published at https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2. As a temporary mitigation for environments unable to immediately patch, restrict host configuration permissions to only highly trusted administrators, implement audit logging for all host modifications, and review existing host configurations for suspicious command syntax in address fields. No workaround fully eliminates risk-patching remains the only complete remediation.