CVE-2026-124079 is a critical (CVSS 3.1 9.8) deserialization flaw in rConfig Core and rConfig Pro that lets unauthenticated network attackers run arbitrary code by pushing a crafted job onto an exposed Redis-backed Laravel Horizon queue.
What Is It
CVE-2026-124079 is a deserialization of untrusted data vulnerability (CWE-502) in rConfig. Affected deployments run the Redis-backed Laravel Horizon queue without authentication. An attacker can push a crafted serialized job onto that queue. Laravel's CallQueuedHandler then unserializes the job without any class restrictions.
This lets the attacker create an instance of the existing App\Jobs\TaskDownloadRun class and run an Artisan command of their choosing. With the bundled laravel/tinker package, the attacker can then execute arbitrary PHP and operating system commands as the queue worker's user.
If Redis is not directly reachable, an authenticated attacker can still deliver the payload through the application. They do this by configuring a device target that points at the rConfig server's loopback address.
Why It Matters
VulnCheck scores this flaw at CVSS 3.1 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (Critical). It can be exploited over the network with low complexity, and the attacker needs no privileges and no user interaction.
According to the record, a successful attacker can:
- Execute arbitrary PHP and OS commands on the rConfig host
- Write a persistent web shell into the web-served
storage/app/publicdirectory - Read database credentials, stored device credentials, and API tokens
rConfig is a network configuration management tool. The stored device credentials it holds can give an attacker a path into the network devices it manages.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation in the wild is not confirmed by KEV at this time.
What's Vulnerable
- rConfig Core: versions 8.0.0 up to, but not including, 8.2.19
- rConfig Pro: all versions before 8.4.1
The record says exposure applies to deployments where the Laravel Horizon queue runs without authentication. The authenticated loopback path means that keeping Redis off the network does not fully close the attack.
Patch Status
The affected version ranges show fixes in rConfig Core 8.2.19 and rConfig Pro 8.4.1. The rConfig GitHub release core-8.2.19 is referenced as a source. Upgrade to these versions or later.
There is no CISA KEV entry, so no federal required action or due date applies. NVD status is "Received" (published 2026-11-09), and NVD has not yet completed its analysis.