CVE-2026-124079

Summary

Unauthenticated remote code execution via insecure deserialization in rConfig's Laravel Horizon queue system, where attackers push malicious serialized jobs to Redis that trigger arbitrary PHP/OS command execution through the TaskDownloadRun class.

Exploitability

Trivial for unauthenticated attackers if Redis is exposed or accessible via the application; requires only network access and knowledge of the vulnerable queue endpoint.

Blast radius

Full system compromise including persistent web shell deployment, credential theft (database, devices, APIs), and lateral movement as the queue worker user.

Detection

Look for unexpected Artisan command executions in Laravel logs (e.g., 'php artisan tinker' or similar), anomalous file creation in storage/app/public/ (especially .php files), and unusual Redis queue job entries containing serialized App\Jobs\TaskDownloadRun payloads with non-standard command arguments.

Prioritized remediation

Upgrade rConfig Core to 8.2.19 or later, or rConfig Pro to 8.4.1 or later; if immediate patching is not possible, restrict Redis access to localhost-only and disable Laravel Horizon queue processing until patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.