CVE-2026-97865: Open Web Analytics RCE Vulnerability

CVE-2026-97865 Overview

CVE-2026-97865 is an insecure deserialization vulnerability in Open Web Analytics (OWA) versions up to and including 1.8.1. The flaw resides in the Event::loadFromArray function within queue.php, which handles the Remote Event Queue Endpoint. An unauthenticated remote attacker can submit crafted input that triggers unsafe PHP unserialize() operations and manipulates internal queue bookkeeping fields. The issue is tracked under [CWE-20: Improper Input Validation] and is addressed in Open Web Analytics 1.8.2 via commit 78c1222ec0e2119d84684032da1541120a2cdd23.

Critical Impact

A remote, unauthenticated attacker can supply event payloads that reach PHP deserialization and overwrite queue state fields such as guid, receive_count, and do_not_receive_before_timestamp, enabling queue poisoning and expanding the attack surface for object injection.

Affected Products

• Open Web Analytics versions up to and including 1.8.1
• Component: Remote Event Queue Endpoint (queue.php)
• Function: Event::loadFromArray in modules/Base/Classes/Event.php

Discovery Timeline

• 2026-09-25 - CVE-2026-97865 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-97865

Vulnerability Analysis

Open Web Analytics exposes a remote event queue endpoint (queue.php) that accepts serialized event data from external senders. The receiver calls Event::loadFromArray to hydrate an Event object from attacker-supplied properties, then passes queue payloads through decodeMessage, which invokes PHP unserialize() without restricting allowed classes.

Two issues compound each other. First, loadFromArray applies no allowlist, so a remote caller can set any property on the event, including queue bookkeeping fields that belong to the receiving instance. Second, decodeMessage historically called unserialize($msg) with no allowed_classes restriction, which turns any writeable queue blob into a potential object-injection sink.

Root Cause

The root cause is improper input validation ([CWE-20]) across the queue ingestion path. loadFromArray treats the incoming array as fully trusted and copies every key onto the event object. Fields such as guid (used as the queue-item primary key), receive_count, and do_not_receive_before_timestamp are retry-state values owned by the receiver, not the sender. Allowing a remote caller to set them lets the caller collide with existing queue items, defer events arbitrarily far into the future, or arrive pre-loaded with a retry count that exceeds limits.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the OWA queue endpoint containing an event payload with injected bookkeeping properties or a serialized blob. If an attacker also controls the queue storage (for example via SQL injection or stolen database credentials), the unrestricted unserialize() call provided a direct path from writing a row to instantiating arbitrary PHP classes during queue processing.

     }
 
     function prepareMessage( $msg ) {
-        
+
         return serialize( $msg );
     }
-    
+
     function decodeMessage ( $msg ) {
-        
-        return unserialize( $msg );
+
+        return unserialize( $msg, array( 'allowed_classes' => self::allowedEventClasses() ) );
+    }

Source: Open Web Analytics Commit 78c1222

The patch replaces the unrestricted unserialize() with an allowed_classes allowlist returned by allowedEventClasses(), converting any untrusted blob that names an unexpected class into a decode failure.

Detection Methods for CVE-2026-97865

Indicators of Compromise

• HTTP POST requests to the OWA queue.php endpoint from unexpected or external source addresses.
• Rows in owa_queue_item with attacker-controlled guid values, non-zero receive_count on first ingestion, or do_not_receive_before_timestamp set far in the future.
• PHP error logs showing unserialize() warnings or references to unknown class names during queue processing.

Detection Strategies

• Inspect web server access logs for requests to queue.php and alert on request bodies containing serialized PHP object markers such as O: followed by a class name and length.
• Monitor the OWA database for anomalous queue-item growth, duplicate guid collisions, or events scheduled with implausible timestamps.
• Deploy web application firewall rules that reject requests to the OWA remote queue endpoint carrying serialized PHP payloads.

Monitoring Recommendations

• Enable verbose logging on the OWA queue processor and forward logs to a centralized analytics platform for correlation with web traffic.
• Track process creation on the OWA host for unexpected PHP spawns, outbound network connections, or file writes initiated during queue runs.
• Baseline normal event-queue sender IP addresses and alert on new or geographically unusual senders.

How to Mitigate CVE-2026-97865

Immediate Actions Required

• Upgrade Open Web Analytics to version 1.8.2 or later, which includes commit 78c1222ec0e2119d84684032da1541120a2cdd23.
• Restrict network access to queue.php so that only trusted upstream OWA instances can reach the remote event queue endpoint.
• Audit the owa_queue_item table for suspicious rows, unexpected guid values, or events deferred by do_not_receive_before_timestamp.

Patch Information

The fix is included in Open Web Analytics Release 1.8.2. Technical context is tracked in Open Web Analytics Issue #960 and Pull Request #967. The patch adds an allowlist of properties that a remote sender may set on an incoming event, and restricts unserialize() to an allowlist of event classes via the allowed_classes option.

Workarounds

• Place the OWA queue endpoint behind authentication, network ACLs, or a reverse proxy that enforces IP allowlisting until the upgrade is applied.
• Disable the remote event queue feature if cross-instance event forwarding is not in use.
• Add a WAF rule to drop requests to queue.php that contain PHP serialized object signatures.

# Example nginx access restriction for the OWA queue endpoint
location = /queue.php {
    allow 10.0.0.0/8;        # trusted upstream OWA senders
    deny all;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}