Command Injection Vulnerability in openITCOCKPIT Monitoring Tool

CVE-2026-24893

What is CVE-2026-24893?

The openITCOCKPIT Community Edition, an open-source monitoring solution, is vulnerable due to a command injection flaw that affects authenticated users with the ability to add or modify hosts. By exploiting this vulnerability, attackers can execute arbitrary operating system commands on the monitoring backend. The flaw exists because user-defined host attributes, specifically the host address, are incorporated into monitoring command templates without adequate validation, escaping, or quoting. As a result, when these templates are executed through the monitoring engine (Nagios/Icinga), it leads to potential remote code execution. This issue has been addressed in version 5.5.2.

References