CVE-2026-124079 is a critical remote code execution vulnerability in rConfig Core and Pro. It stems from unsafe deserialization in the Redis-backed job queue.An unauthenticated network attacker may execute code when the queue is directly reachable without authentication. NVD records CVSS 4.0 9.3 Critical and CVSS 3.1 9.8 Critical scores from the VulnCheck CNA.
What it allows
How Does CVE-2026-124079 Affect rConfig?
Affected deployments run a Redis-backed Laravel Horizon queue without authentication. The queue worker deserializes submitted jobs without restricting which classes may be created.
A network attacker who can reach that queue may submit a crafted job that invokes existing application functionality. The resulting commands run with the queue worker's operating-system privileges.
NVD also describes a second route when Redis is not directly reachable. A signed-in attacker may configure a device target that redirects the job toward the server's internal queue.
Successful exploitation may expose database credentials, stored device credentials, and API tokens. It may also let an attacker establish persistence and affect confidentiality, integrity, and availability.
Who is affected
rConfig's advisory lists Core 8.0.0 through 8.2.18 as affected and fixed in 8.2.19. It lists Pro versions through 8.4.0 as affected and fixed in 8.4.1.
The vendor's broader security page recommends Core 8.2.20 or later because a separate issue also affects 8.2.19. Pro administrators should install 8.4.1 or later and check the vendor page for newer releases.
What to do
-
Upgrade Core to 8.2.20 or later
Although this CVE was fixed in Core 8.2.19, rConfig recommends 8.2.20 or later because another security issue affects 8.2.19. Verify the installed release after maintenance.
-
Upgrade Pro to 8.4.1 or later
Apply rConfig Pro 8.4.1 or a later available release. Confirm the update covers every deployment in your vulnerability management inventory.
-
Remove unauthenticated queue exposure
Confirm Redis requires authentication and is not reachable from untrusted networks. Restrict access to the application and its supporting services while upgrades are underway.
-
Rotate secrets after upgrading
rConfig advises rotating REST API tokens, device and enable passwords, SMTP credentials, and LDAP and RADIUS secrets. Review the user list for unrecognized accounts.
-
Review queue-worker and host activity
Brandefense recommends reviewing queue, application, process, and authentication telemetry for unexpected activity. Preserve relevant evidence and follow your incident response plan when anomalies appear.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124079?
It is a critical unsafe deserialization vulnerability in the rConfig job queue. Attackers may execute code with the queue worker's operating-system privileges.
Can CVE-2026-124079 be exploited without authentication?
Yes, when the Redis-backed queue is directly reachable without authentication. NVD also describes an indirect application route that requires a signed-in attacker.
Which rConfig versions are affected by CVE-2026-124079?
The vendor lists Core 8.0.0 through 8.2.18 and Pro through 8.4.0 as affected. It marks Core 8.2.19 and Pro 8.4.1 as this CVE's fixes.
What should rConfig administrators install?
rConfig recommends Core 8.2.20 or later because a separate flaw affects 8.2.19. Pro administrators should install 8.4.1 or a later available release.
Sources
- rConfig Security Advisoriesrconfig.com
- GitHub Advisory GHSA-chv8-5vwm-w6cjGitHub
- NVD: CVE-2026-124079NIST NVD
