RConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization…

rConfig Core

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments.

Do this now

Check the advisory for a fix and restrict access to rConfig Core meanwhile.

First seen: 11 Nov 2026
Last update: 11 Nov 2026, 06:18 UTC
Versions per the CVE record from VulnCheck, not the vendor: rConfig Core 8.2.19
rConfig Pro 8.4.1
Identifiers: CVE-2026-124079
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## RConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization…
Severity: critical. Patch status: fix status unknown.
Affected: rConfig Core
Versions per the CVE record from VulnCheck, not the vendor: rConfig Core 8.2.19, rConfig Pro 8.4.1
Ids: CVE-2026-124079

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments.

## Steps
1. Search the repo, its CI and infra config for rConfig Core. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from VulnCheck, not the vendor: rConfig Core: 8.2.19. rConfig Pro: 8.4.1. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| rConfig Core | per the CVE record from VulnCheck, not the vendor | 8.2.19 | restrict network access to it |
| rConfig Pro | per the CVE record from VulnCheck, not the vendor | 8.4.1 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-124079") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/rconfig/rconfig/releases/tag/core-8.2.19 https://nvd.nist.gov/vuln/detail/CVE-2026-124079
https://pwned.coffee/i/rconfig-core-8-0-0-before-8-2-19-and-rconfig-pro-before-cve-2026-124079

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from VulnCheck, not the vendor: Product Affected Version named Source
rConfig Core before 8.2.19 8.2.19 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
rConfig Pro before 8.4.1 8.4.1 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA VulnCheck) for CVE-2026-124079
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Version named	Source
rConfig Core	before 8.2.19	8.2.19	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov
rConfig Pro	before 8.4.1	8.4.1	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 13 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee