CybersecurityVulnerability Management

Unpatched Kaltura Flaws Expose Servers to Remote Code Execution

Analyst 207||Source: TheHackerNews
Rows of server racks and networking equipment in a shared data center with technicians in the background.

"Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts," CERT/CC said in the vulnerability note.

Two unpatched flaws: CVE-2026-19913 and CVE-2026-19912

The CERT Coordination Center (CERT/CC) disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library — tracked as CVE-2026-19913 and CVE-2026-19912 — that allow a remote, unauthenticated attacker to read arbitrary files from a server and to execute code on it. Both issues originate in unsafe deserialization inside the mwEmbedLoader.php endpoint (also distributed as html5lib). No patch was available at the time of CERT/CC's advisory, and CERT/CC said it was "unable to reach Kaltura to coordinate these vulnerabilities."

How the file-read flaw (CVE-2026-19913) works

  • mwEmbedLoader.php accepts a ServiceUrl parameter and uses it as the target for backend API requests.
  • The KalturaClientBase PHP client fetches whatever that URL returns and passes it to PHP's unserialize() without validating source, scheme, or content.
  • Supplying a file:// path causes the server to fetch a local file; when deserialization fails, the raw bytes of that file are reflected back to the requester inside the resulting error message.
  • Researcher Gerjan Wemekamp escalated the file-read to retrieve /opt/kaltura/app/configurations/local.ini, which the writeup says contains plaintext database connection strings, admin and console passwords, and internal host references.

How the RCE chain (CVE-2026-19912) works

The second vulnerability converts the unsafe deserialization into remote code execution by chaining ServiceUrl with the uiconf_id parameter. An attacker can point ServiceUrl at a malicious serialized object carrying executable PHP. The client fetches and deserializes it. If uiconf_id contains directory-traversal sequences (for example, ../), the application writes the deserialized payload outside the intended cache folder and into a web-accessible directory. Requesting that file then executes it as the web-server user.

The write step depends on Kaltura's default file-based cache backend; Wemekamp notes a memcache-only configuration may suppress the write but "does not make the deployment safe." Wemekamp demonstrated the end‑to‑end web shell drop on the Kaltura Server docker image from 2019 and verified that, on current releases, "both halves of the chain are present, and that the deserialization half still executes as described."

Scope: affected releases, shared hosts, and code history

  • CERT/CC lists affected releases as html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable endpoint.
  • CERT/CC warns the loader is exposed on customer installations and on Kaltura's own shared production hosts; because the endpoint appears on Kaltura's multi-tenant CDN, every tenant served by those hosts may be affected.
  • The Hacker News verified that deployment/uiconf/KalturaClientBase.php, the file containing the unserialize() call, is byte-identical across 21 release refs ranging from Jupiter-10.9.0 (committed April 27, 2015) to West-23.5.0 (committed August 13, 2026); the call and error-message reflection date back to a release ref committed on March 10, 2014.
  • No exploitation had been reported at the time of writing, neither CVE appeared in CISA's Known Exploited Vulnerabilities catalog as of August 25, 2026, and there was no NVD record for either identifier on that date.

Mitigations CERT/CC and the researcher recommend

  • Block or remove the endpoint at the WAF, reverse proxy, or CDN where legacy mwEmbed players are not being served.
  • Allow-list ServiceUrl so only the deployment's own API host is permitted and non-HTTP(S) schemes are rejected.
  • Reject uiconf_id values containing traversal sequences, absolute paths, or directory separators.
  • Deny PHP execution in cache directories and restrict outbound network access from the application server (the RCE path requires fetching an external payload).
  • Rotate everything in local.ini where the endpoint has been exposed: database credentials, admin and console passwords, partner secrets, and API keys.

What this means for Kaltura customers, administrators, and incident responders

  • Kaltura customers should inventory deployments that use html5lib (v2.x) and confirm whether the mwEmbedLoader.php endpoint is externally reachable, including on shared CDN hosts.
  • System administrators need to implement the allow-list for ServiceUrl, enforce strict checks on uiconf_id, block non-HTTP(S) schemes, and consider denying PHP execution in cache directories; where exposure occurred, they must rotate secrets stored in local.ini.
  • Incident responders should monitor for requests containing file:// URIs, unexpected error responses reflecting raw file bytes, and uiconf_id values with traversal sequences, and be prepared to hunt for web-shell drops—Wemekamp's writeup included a verified web-shell demonstration on a 2019 docker image.

Both flaws were scored by the reporter: CVE-2026-19912 at 10.0 and CVE-2026-19913 at 9.1. CERT/CC published the advisory after escalation activity beginning March 23, 2026, according to the researcher's timeline: initial report on March 23, a re-send from a corporate address on April 13, a LinkedIn message to the vendor's CISO on May 23, an escalation through a national CERT on July 2, and CERT/CC notification on July 8. CERT/CC's advisory lists Kaltura's status for both CVEs as Unknown and records that it was "unable to reach Kaltura to coordinate these vulnerabilities."

The immediate facts are stark: unsafe unserialize() behavior exists in code spanning commits back to 2014 and was present in release refs committed through August 13, 2026; no vendor patch had been published as of the advisory; and administrators are left to apply configuration and network mitigations and to rotate exposed secrets. Until Kaltura issues a coordinated fix, those operational steps are the only practical barrier between exposed deployments and a working remote file-read or code-execution chain.

Original Hacker News report

Emerging ThreatsRemote Code ExecutionSupply ChainVulnerability ManagementCERT/CCKalturaCVE-2026-19913CVE-2026-19912Mwembed
Related Intelligence

Continue Reading

Security analysts work amidst multiple computer screens in a monitoring room with subtle signs of disarray.

CISA Red Team Tests Expose Organizational Vulnerabilities

CISA's red team tests revealed some eye-opening vulnerabilities, with the team slipping past security operations centers undetected, gaining access to workstations, escalating privileges, and moving freely between systems. This simulated cyber attack exposed weaknesses in critical infrastructure organizations, highlighting areas for improvement in detecting and responding to threats.

Analyst 207
Government facility with industrial and security elements under daylight.

CISA Red Team Exposes Gaps in Critical Infrastructure Defenses

The CISA red team uncovered alarming gaps in critical infrastructure defenses, revealing that even with detection tools in place, the real vulnerability lies in the people, processes, and procedures supporting them. In a striking example, a recent red-team exercise showed that detection tools can be ineffective if not backed by robust supporting systems.

Analyst 207
Empty office cubicle with laptop, smartphone, and papers, surrounded by blurred coworkers' spaces and a large window.

AI Tools Operate Largely Unchecked, Heightening Security Risks

Most AI tools are flying under the radar, with a staggering 80% operating without IT oversight in enterprise ecosystems, leaving organizations vulnerable to security risks. This alarming lack of governance is even more pronounced in smaller organizations, according to Reco's latest findings.

Analyst 207
Network operations room with computer workstations and equipment.

Ubiquiti Disrupts Three Max-Severity Flaws in UniFi Systems

Ubiquiti has just dropped a critical security update to fix three massive vulnerabilities in its UniFi systems that hackers can exploit remotely without needing any special access. If you're using UniFi, now's the time to patch up and keep your network safe!

Analyst 207