CVE-2026-14453: A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The messageconfirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14453?
CVE-2026-14453 has a critical severity rating of 9.6.
How does CVE-2026-14453 affect the Centreon software?
CVE-2026-14453 allows low-privileged users to inject SSTI templates leading to Remote Code Execution in the centreon-open-tickets module of Centreon.
Who is impacted by CVE-2026-14453?
Any authenticated user with low privileges in the Centreon system can exploit CVE-2026-14453.
How do I fix CVE-2026-14453?
To mitigate CVE-2026-14453, ensure that inputs in the message_confirm field are properly sanitized and update to the latest secure version of the Centreon software.
What type of attack does CVE-2026-14453 enable?
CVE-2026-14453 enables Server-Side Template Injection, which can result in Remote Code Execution.