Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-24891 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in It-Novum Openitcockpit. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24891 is an unsafe deserialization vulnerability (CWE-502) in openITCOCKPIT, an open source monitoring tool for engines like Nagios, Naemon, and Prometheus. It affects versions 5.3.1 and below, specifically in the Gearman worker implementation. The worker function oitc_gearman calls PHP's unserialize() on job payloads without enforcing class restrictions or validating data origin, creating a PHP Object Injection sink. While intended deployments assume trusted internal components enqueue jobs, the code does not enforce this trust boundary.
Exploitation requires network access (AV:N) to the Gearman service, high attack complexity (AC:H), and low privileges (PR:L), with no user interaction needed (UI:N) and unchanged scope (S:U). Attackers can submit crafted serialized payloads if Gearman listens on non-local interfaces, TCP/4730 access is unrestricted, or untrusted systems can enqueue jobs. Successful exploitation triggers PHP Object Injection in the worker process, enabling high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 score of 7.5.
The vulnerability is addressed in openITCOCKPIT version 5.4.0. Security practitioners should upgrade to this version to eliminate the unsafe sink. Additional details are available in the GitHub security advisory at https://github.com/openITCOCKPIT/openITCOCKPIT/security/advisories/GHSA-x4mq-8gfg-frc4 and release notes at https://github.com/openITCOCKPIT/openITCOCKPIT/releases/tag/openITCOCKPIT-5.4.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8363
Vulnerability Data
openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. Versions 5.3.1 and below contain an unsafe deserialization sink in the Gearman worker implementation. The worker function registered as oitc_gearman calls PHP's unserialize()…
more
on job payloads without enforcing class restrictions or validating data origin. While the intended deployment assumes only trusted internal components enqueue Gearman jobs, this trust boundary is not enforced in application code. In environments where the Gearman service or worker is exposed to untrusted systems, an attacker may submit crafted serialized payloads to trigger PHP Object Injection in the worker process. This vulnerability is exploitable when Gearman listens on non-local interfaces, network access to TCP/4730 is unrestricted, or untrusted systems can enqueue jobs. Default, correctly hardened deployments may not be immediately exploitable, but the unsafe sink remains present in code regardless of deployment configuration. Enforcing this trust boundary in code would significantly reduce risk and prevent exploitation in misconfigured environments. This issue has been fixed in version 5.4.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can uncover deserialization flaws before deployment.
Input validation directly stops deserialization of untrusted data by ensuring inputs are valid before processing.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
Requiring vetted libraries, regular updates and SAST before release reduces the likelihood that deserialization logic will accept and act on attacker-controlled serialized objects.
Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.