openITCOCKPIT up to 5.3.x Gearman Service unserialize deserialization

Summaryinfo

A vulnerability described as problematic has been identified in openITCOCKPIT up to 5.3.x. This affects the function unserialize of the component Gearman Service. The manipulation results in deserialization. This vulnerability is cataloged as CVE-2026-24891. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in openITCOCKPIT up to 5.3.x. Affected is the function unserialize of the component Gearman Service. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in version 5.4.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-24891 since 01/27/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 5.4.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• openITCOCKPIT

Version

• 5.0
• 5.1
• 5.2
• 5.3

Website

• Product: https://github.com/openITCOCKPIT/openITCOCKPIT/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion