CVE-2026-24893
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedopenITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceopenITCOCKPIT Community Edition before 5.5.2 contains a command injection vulnerability where authenticated users with host add/modify permissions can execute arbitrary OS commands. The host address field is inserted into monitoring command templates (Nagios/Icinga) without validation, escaping, or quoting, and the monitoring engine executes these templates via shell, leading to remote code execution.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 5.5.2CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify openITCOCKPIT versionCheck the installed version of openITCOCKPIT Community Edition. This can typically be found in the web interface under 'System' > 'System Information' or by checking the package version on the server (e.g., dpkg -l | grep openitcockpit or similar package manager command).Affected if The installed version is lower than 5.5.2
-
Verify monitoring engine configurationInspect the Nagios/Icinga configuration to confirm that monitoring command templates execute via shell. Check the command definitions in the monitoring configuration files (typically in /etc/nagios/ or /etc/icinga/ under objects or conf.d directories) for any commands that pass host address attributes directly to shell execution.Affected if Monitoring commands pass host address variables to shell execution without escaping or quoting
-
Review user permissions for host managementIn the openITCOCKPIT web interface, navigate to 'Administration' > 'Users' or 'Permissions' and identify which users or roles have 'Host add' or 'Host modify' permissions granted.Affected if Any user account with host add/modify permissions exists in the system (especially non-admin users)
-
Examine host address field handlingCreate a test host or examine existing host configurations in the openITCOCKPIT interface. Review how the 'Address' field from host definitions is referenced in the monitoring command templates used by Nagios/Icinga.Affected if Host address fields are directly inserted into command templates without validation or escaping
A system is affected if it runs openITCOCKPIT Community Edition version below 5.5.2 and has users with host add/modify permissions, with monitoring commands that pass host address attributes to shell execution.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped5.5.2
Upgrade to openITCOCKPIT version 5.5.2 or later. If immediate upgrade is not possible, restrict host creation/modification permissions to only highly trusted users and monitor for suspicious command patterns in host addresses.
5.5.2
- Upgrade openITCOCKPIT Community Edition to version 5.5.2 or later to remediate the command injection vulnerability
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation12.0 h
- Testing6.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,040.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-24893 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-24893 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data