CVE-2026-14453: Centreon Open Tickets SSTI RCE Vulnerability

CVE-2026-14453 Overview

CVE-2026-14453 is a Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module that enables Remote Code Execution (RCE). The message_confirm field is stored without sanitization and rendered through the Smarty template engine with no security policy enforced. Any authenticated user can inject template directives that execute arbitrary code on the underlying Centreon Infra Monitoring server. Successful exploitation exposes environment secrets and can degrade platform availability. The weakness is classified under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Authenticated attackers can achieve Remote Code Execution on the Centreon monitoring server, leading to disclosure of environment secrets and disruption of monitoring availability.

Affected Products

Centreon Infra Monitoring platform
Centreon centreon-open-tickets module
Deployments using Smarty template rendering without a security policy

Discovery Timeline

2026-07-13 - CVE-2026-14453 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-14453

Vulnerability Analysis

The centreon-open-tickets module accepts a message_confirm value from an authenticated user and persists it without sanitization. When the ticket workflow renders that value, Centreon passes the stored string directly to the Smarty template engine. Smarty is invoked without enabling its Smarty_Security policy, so template tags embedded in user input are compiled and executed rather than treated as literal text.

Because Smarty templates can invoke PHP functions and modifiers, an attacker who controls the template body controls PHP execution on the server. The result is arbitrary code execution under the account running the Centreon web stack. Attackers can read configuration files, exfiltrate database credentials, and pivot into the monitored infrastructure through Centreon's collector connections.

Root Cause

The root cause is dual: missing input validation on the message_confirm field, and insecure use of the Smarty engine. Smarty rendering runs in full-trust mode without a security policy, so any template syntax provided by a user is treated as code. This maps directly to [CWE-94] Improper Control of Generation of Code.

Attack Vector

Exploitation requires network access to the Centreon web interface and a valid low-privileged account. The attacker submits a crafted message_confirm payload containing Smarty directives through the open-tickets workflow. When the message is rendered during ticket confirmation, the payload executes server-side. The scope change means code runs with the privileges of the Centreon service account, beyond the attacker's original session boundary.

See the Centreon Release Notes for the affected component and remediation details.

Detection Methods for CVE-2026-14453

Indicators of Compromise

Ticket records where message_confirm contains Smarty delimiters such as {php}, {if}, {literal}, or {$smarty.
Unexpected child processes spawned by the PHP-FPM or Apache worker serving Centreon (for example sh, bash, curl, wget, python)
Outbound connections from the Centreon host to attacker-controlled infrastructure shortly after ticket submission
New or modified files under Centreon web directories that were not written by a package update

Detection Strategies

Inspect HTTP POST bodies to open-tickets endpoints for Smarty tag syntax in the message_confirm parameter
Query the Centreon database for stored ticket messages containing { followed by PHP function names such as system, exec, passthru, or file_get_contents
Correlate authenticated Centreon sessions with process-creation events on the monitoring host to identify template-triggered command execution
Alert on Centreon web workers reading /etc/passwd, environment files, or SSH keys

Monitoring Recommendations

Enable web server access logging with full URI and referrer capture on the Centreon front end
Forward Centreon audit logs and PHP error logs to a centralized SIEM for retention and correlation
Baseline the expected process tree of the Centreon web service and alert on deviations
Monitor egress traffic from Centreon collectors and central servers to detect data exfiltration

How to Mitigate CVE-2026-14453

Immediate Actions Required

Upgrade Centreon and the centreon-open-tickets module to the fixed release listed in the vendor advisory
Restrict access to the Centreon web interface to trusted administrative networks until patching is complete
Rotate credentials, API tokens, and secrets stored in the Centreon environment, assuming disclosure
Review ticket history for message_confirm entries containing Smarty syntax and purge malicious records

Patch Information

Centreon has published fixed versions in its release stream. Review the Centreon Release Notes for the specific centreon-open-tickets module version that removes the SSTI condition, and apply the upgrade through the standard package channels.

Workarounds

Disable the centreon-open-tickets module if it is not required for operations
Restrict low-privileged Centreon accounts from accessing ticket workflows through role and ACL configuration
Place the Centreon web interface behind a Web Application Firewall (WAF) with rules that block Smarty delimiters in POST bodies to open-tickets endpoints
Enforce network segmentation so the Centreon host cannot initiate arbitrary outbound connections

bash

# Example WAF-style ModSecurity rule to block Smarty tags in ticket submissions
SecRule REQUEST_URI "@contains /centreon-open-tickets/" \
  "chain,phase:2,deny,status:403,id:1014453,\
   msg:'Potential Smarty SSTI in message_confirm (CVE-2026-14453)'"
  SecRule ARGS:message_confirm "@rx \{(php|if|literal|assign|\$smarty)" \
    "t:none,t:lowercase"