CVE-2026-124079

{
  "etk_id": "ETK-2026-3961",
  "cve_id": "CVE-2026-124079",
  "display_id": "CVE-2026-124079",
  "ghsa_id": "GHSA-chv8-5vwm-w6cj",
  "euvd_id": "EUVD-2026-120037",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated queue deserialization in rConfig Core and Pro",
  "summary": "rConfig Core versions 8.0.0 through 8.2.18 and rConfig Pro versions before 8.4.1 are affected by unsafe job deserialization in deployments using the Redis-backed Horizon queue. An attacker who can reach an unauthenticated queue can run code with the queue worker's privileges; where the queue is not directly reachable, an authenticated user may be able to trigger the issue through application configuration.",
  "mitigation": "Upgrade rConfig Core to 8.2.19 or later and rConfig Pro to 8.4.1 or later. Restrict Redis and Horizon queue access to trusted hosts and require authentication until all affected instances are updated.",
  "vendor": "rConfig",
  "product": "rConfig Core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.0.0, < 8.2.19"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.2.19"
      ],
      "package_name": "rConfig Core",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 8.4.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.4.1"
      ],
      "package_name": "rConfig Pro",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 79.72862035,
  "t0_at": "2026-11-09T12:22:06.929000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T12:22:06.929000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T12:22:06.929000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-124079"
    }
  }
}