# CVE-2026-124079: rConfig remote code execution via job queue deserialization

Source: https://junglewise.ai/threats/cve-2026-124079-rconfig-core-8-0-0-before-8-2-19-and-rconfig-pro-before-8-4-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124079 · Severity: critical · CVSS 9.8 · Published 2026-11-09

rConfig is a network configuration management platform that stores device configurations and credentials. Unauthenticated attackers can execute arbitrary code by sending a crafted job to the Redis queue, allowing them to steal credentials, install web shells, and take over the server. The vulnerability affects both rConfig Core and rConfig Pro before patched versions.

Technologies: [rConfig Core](https://junglewise.ai/threats/technologies/rconfig-core). Vendors: [Rconfig](https://junglewise.ai/threats/vendors/rconfig).

## Quick answers

**Is CVE-2026-124079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124079 being exploited in the wild.

**How severe is CVE-2026-124079?** Critical severity, with a CVSS score of 9.8, published 9 November 2026.

**Which products and versions are affected?** rConfig Core 8.0.0 to 8.2.18; rConfig Pro up to 8.4.0.

**Is there a fix for CVE-2026-124079?** Yes: fixed in rConfig Core 8.2.19 or later; rConfig Pro 8.4.1 or later. Until then: Redis now requires authentication; Horizon and scheduler no longer run as root; device targets pointing to the rConfig server itself are now blocked. After upgrading, rotate all stored secrets including REST API tokens, device and enable passwords, and SMTP/LDAP/RADIUS credentials.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-11-06"
  },
  {
    "kind": "patched",
    "at": "2026-10-27",
    "note": "rConfig Core 8.2.19 released"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124079 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124079?** Check whether you run rConfig Core or rConfig Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in rConfig Core 8.2.19 or later; rConfig Pro 8.4.1 or later

Redis now requires authentication; Horizon and scheduler no longer run as root; device targets pointing to the rConfig server itself are now blocked. After upgrading, rotate all stored secrets including REST API tokens, device and enable passwords, and SMTP/LDAP/RADIUS credentials.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-11-06"
  },
  {
    "kind": "patched",
    "at": "2026-10-27",
    "note": "rConfig Core 8.2.19 released"
  }
]

## Technical details

Laravel Horizon deserializes untrusted job objects from the Redis queue without class restrictions, allowing instantiation of App\Jobs\TaskDownloadRun and execution of arbitrary Artisan commands. Attackers can leverage the bundled laravel/tinker package to execute arbitrary PHP and OS commands as the queue worker. Attack requires network access to the unprotected Redis queue in default deployments; alternatively, authenticated users can deliver the payload through a loopback-targeted device configuration.

## Affected products

- rConfig rConfig Core 8.0.0 to 8.2.18
- rConfig rConfig Pro up to 8.4.0

## References

- [https://github.com/rconfig/rconfig/releases/tag/core-8.2.19](https://github.com/rconfig/rconfig/releases/tag/core-8.2.19)
- [https://www.rconfig.com/security-advisories](https://www.rconfig.com/security-advisories)

## Related threats

- [rConfig Core information disclosure in device-credentials API](https://junglewise.ai/threats/cve-2026-70555-rconfig-core-8-2-3-before-8-2-13-contains-an-information)
- [rConfig Core unauthenticated self-registration with Admin privilege escalation](https://junglewise.ai/threats/cve-2026-77915-rconfig-core-unauthenticated-self-registration-with-admin)
- [rConfig Core privilege escalation in Users API role field](https://junglewise.ai/threats/cve-2026-63102-rconfig-core-privilege-escalation-in-users-api-role-field)