rConfig's Redis queue became an unauthenticated code path

Network configuration management systems hold credentials for the devices they manage. They are high-value because a single login can reach routers, switches, firewalls, and the configuration history that explains how those devices were built. CVE-2026-124079 adds a second problem: in affected rConfig deployments, the job queue itself may be reachable without authentication.

The CVE record describes unsafe deserialization in rConfig Core before 8.2.19 and rConfig Pro before 8.4.1. An unauthenticated network attacker can push a crafted serialized job onto a Redis-backed Laravel Horizon queue. When a worker processes the job, the payload can result in arbitrary code execution. The vulnerability is not a browser-side trick that needs a logged-in administrator.…