🚨 CRITICAL - Centreon Open Tickets Smarty SSTI leads to RCE (CVE-2026-14453) A Server-Side Template Injection (SSTI) flaw in Centreon’s centreon-open-tickets module affects how the message_confirm field is stored and later rendered by the Smarty template engine. The root cause is improper input sanitization combined with unsafe template rendering (Smarty used without an enforced security policy), enabling template injection. An authenticated attacker can inject malicious Smarty payloads into message_confirm and trigger rendering to execute arbitrary code on the server under the Centreon application context. If exploited, this can result in remote code execution, exposure of environment secrets/credentials, and disruption of availability across the Centreon Infra Monitoring platform. 👉 Affected: Centreon centreon-open-tickets (versions not specified) | No fix yet - treat as suspicious
Post summary
The post discloses a new SSTI vulnerability (CVE-2026-14453) in Centreon’s centreon-open-tickets module that enables authenticated attackers to execute arbitrary code via the Smarty engine; no fix is available yet and there is no evidence of active exploitation.