CVE-2026-124079

Name of the Vulnerable Software and Affected Versions rConfig Core versions 8.0.0 through 8.2.18 rConfig Pro versions prior to 8.4.1

Description Insecure deserialization of untrusted data allows unauthenticated network attackers to execute arbitrary code. The issue occurs when a crafted serialized job is pushed onto the Redis-backed Laravel Horizon queue, which operates without authentication in affected deployments. The CallQueuedHandler function unserializes the job without class restrictions, enabling attackers to instantiate the AppJobsTaskDownloadRun class and invoke an attacker-controlled Artisan command. By leveraging the laravel/tinker package, attackers can execute arbitrary PHP and operating system commands as the queue worker user, write a persistent web shell into the storage/app/public directory, and access database credentials, stored device credentials, and API tokens. If Redis is not directly reachable, authenticated attackers can deliver the payload by configuring a device target pointing to the server's loopback address.

Recommendations Update rConfig Core to version 8.2.19. Update rConfig Pro to version 8.4.1. Restrict access to Redis to minimize the risk of exploitation.