CVE-2026-124079— rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning

Quick assessment

Affected

rConfig rConfig Core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rConfig Core 8.0.0 至 8.2.19 之前的版本，以及 rConfig Pro 8.4.1 之前的版本，存在一个反序列化不受信任数据漏洞。该漏洞允许未认证的远程网络攻击者，通过向基于 Redis 的 Laravel Horizon 队列推送精心构造的序列化任务，执行任意代码。在受影响的部署环境中，该队列无需身份验证即可运行。Laravel 的组件在反序列化任务时未对类进行限制，使得攻击者能够实例化现有的类，并调用由攻击者控制的 Artisan 命令。攻击者可利用随附的包，以队列工作进程的用

CVSS 9.8 · Critical Updated Nov 09, 2026

Possible ATT&CK Techniques 3 AI

T1584.001 · Domains T1059.006 · Python T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning

Source: CVE Program / CVE List V5

Vulnerability Description

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rConfig	rConfig Core	8.0.0 ~ 8.2.19	-
rConfig	rConfig Pro	0 ~ 8.4.1	-

II. Public POCs for CVE-2026-124079

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124079

请登录查看更多情报信息。

Other References for CVE-2026-124079 (3)

https://www.rconfig.com/security-advisories vendor-advisory
https://github.com/rconfig/rconfig/releases/tag/core-8.2.19 patch
https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124079

IV. Related Vulnerabilities

Same vendor: rConfig

Same weakness: CWE-502