OpenTSDB - RCE (CVE-2023-25826)
Description
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.
psychologyCrowdSec Analysis
CVE-2023-25826 is a remote code execution vulnerability in OpenTSDB caused by inadequate input validation in the legacy HTTP query API. Attackers can exploit this flaw by injecting malicious OS commands into API parameters, potentially gaining full control over the host system. This issue persists due to an incomplete fix and ineffective regex validation, making OpenTSDB deployments susceptible to remote exploitation and system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-25826 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit OpenTSDB's /q endpoint by injecting shell metacharacters into the key query parameter, enabling unauthenticated remote code execution on vulnerable systems.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-05-03 |
| Rule Released | 2025-03-05 |