# CVE-2023-25826: OpenTSDB - RCE

> Live exploitation tracking for CVE-2023-25826 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-25826

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** OpenTSDB
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

## Description

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.

## CrowdSec analysis

[CVE-2023-25826](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-25826) is a remote code execution vulnerability in OpenTSDB caused by inadequate input validation in the legacy HTTP query API. Attackers can exploit this flaw by injecting malicious OS commands into API parameters, potentially gaining full control over the host system. This issue persists due to an incomplete fix and ineffective regex validation, making OpenTSDB deployments susceptible to remote exploitation and system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-25826 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit OpenTSDB's `/q` endpoint by injecting shell metacharacters into the `key` query parameter, enabling unauthenticated remote code execution on vulnerable systems.

## Timeline

- 2023-05-03: CVE Published. CVE-2023-25826 is published to NVD.
- 2025-03-05: Rule Released. CrowdSec releases a rule to detect CVE-2023-25826 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/OpenTSDB/opentsdb/pull/2275

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-25826) follows observed exploitation activity for CVE-2023-25826. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.