Deserialization Vulnerability in rConfig Core and Pro by rConfig

CVE-2026-124079

What is CVE-2026-124079?

rConfig Core versions prior to 8.2.19 and rConfig Pro versions before 8.4.1 exhibit a vulnerability that allows unauthenticated network attackers to execute arbitrary code. This occurs through a deserialization flaw when attackers push a specially crafted serialized job onto the Redis-backed Laravel Horizon queue. The vulnerability arises from Laravel's CallQueuedHandler, which unserializes this job without imposing class restrictions. As a result, attackers can instantiate the App\Jobs\TaskDownloadRun class and execute an arbitrary Artisan command. By leveraging the included laravel/tinker package, it becomes possible to run arbitrary PHP and operating system commands, inject persistent web shells, and extract sensitive information such as database credentials and API tokens. In scenarios where Redis is not directly accessible, attackers with authenticated access can exploit the vulnerability through the application, manipulating a device target that directs traffic to the rConfig server's loopback address.

References