CVE-2026-124079

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address.

• CWE-502

• https://github.com/rconfig/rconfig/releases/tag/core-8.2.19
• https://www.rconfig.com/security-advisories
• https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning

Published

Nov 9, 2026

Last Modified

Nov 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124058A weakness has been identified in TOTOLINK CA300-PoE 6.2c.88…9.1
• CVE-2026-124059A security vulnerability has been detected in TOTOLINK CA300…9.1
• CVE-2026-12406The User Frontend: AI Powered Frontend Posting, User Directo…5.3
• CVE-2026-124060A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884.…9.1
• CVE-2026-12407The E2Pdf – Export Pdf Tool for WordPress plugin for WordPre…8.8
• CVE-2026-124078plist.js (npm package 'plist') before 5.0.1 contains an unco…7.5
• CVE-2026-12408The Slim SEO – A Fast & Automated SEO Plugin For WordPress p…4.3
• CVE-2026-12409The Landing Page Builder – Coming Soon page, Maintenance Mod…4.3
• CVE-2026-1241The Pelco, Inc. Sarix Professional 3 Series Cameras are vuln…8.7
• CVE-2026-12410Link following vulnerability in the Uninstaller component in…7.8
• CVE-2026-12411Broken Access Control in the devLXDInstancePatchHandler comp…9.6
• CVE-2026-12412Rejected reason: loading template...