CVE-2026-24893

openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically the host address) are expanded into monitoring command templates without validation, escaping, or quoting. These templates are later executed by the monitoring engine (Nagios/Icinga) via a shell, resulting in remote code execution. Version 5.5.2 patches the issue.

• CWE-20
• CWE-78
• CWE-78

• https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.5.2Product, Release Notes
• https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-789q-pw85-j2q2Mitigation, Vendor Advisory
• https://openitcockpit.io/blog/posts/2026/2026-04-14-openitcockpit-agent-3.6.0-and-5.5.2Press/Media Coverage, Release Notes

Published

Apr 14, 2026

Last Modified

Jul 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24888Maker.js is a 2D vector line drawing and shape modeling for …9.8
• CVE-2026-24889soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic …5.3
• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5
• CVE-2026-24892openITCOCKPIT is an open source monitoring tool built for di…8.8
• CVE-2026-24894FrankenPHP is a modern application server for PHP. Prior to …7.5
• CVE-2026-24895FrankenPHP is a modern application server for PHP. Prior to …9.8
• CVE-2026-24896OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24897Erugo is a self-hosted file-sharing platform. In versions up…8.8
• CVE-2026-24898OpenEMR is a free and open source electronic health records …9.8
• CVE-2026-24899Fleet is open source device management software. Prior to ve…7.5