OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection
CVE-2023-25826
Verified
Description
OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters.
Severity
Critical
CVSS Score
9.8
Exploit Probability
43%
Affected Product
opentsdb
Published Date
August 20, 2026
Template Author
aryu-ru
CVE-2023-25826.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2023-25826
CWE ID:
cwe-78
Remediation Steps
Implement comprehensive input validation and update to the latest version that addresses this issue.