CVE-2026-14453
Received Received - Intake

Server-Side Template Injection in Centreon Open-Tickets Module

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Centreon

Description
This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The message_confirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to inject and execute arbitrary code on the server. This results in disclosure of environment secrets and could impact platform availability of Centreon Infra Monitoring product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-14453
EUVD
EUVD-2026-43316

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
centreon centreon-open-tickets *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

This vulnerability allows remote code execution through a Server-Side Template Injection in Centreon's centreon-open-tickets module, leading to disclosure of environment secrets and potential impact on platform availability.

Such unauthorized disclosure of sensitive information and disruption of service could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system availability.

Mitigation Strategies

The vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that allows remote code execution via the unsanitized message_confirm field.

Immediate mitigation steps include updating Centreon to a version where this vulnerability is fixed. Check the official Centreon GitHub releases page for patches or updated versions that address this issue.

Additionally, restrict authenticated user permissions to minimize the risk of exploitation until a patch is applied.

Executive Summary

This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that allows Remote Code Execution.

The issue arises because the message_confirm field is stored without sanitization and rendered via the Smarty template engine with no security policy enabled.

As a result, any authenticated user can inject and execute arbitrary code on the server.

Impact Analysis

This vulnerability can lead to disclosure of environment secrets, which may expose sensitive information.

It can also impact the availability of the Centreon Infra Monitoring platform by allowing attackers to execute arbitrary code remotely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart