{"id":"CVE-2026-105044","kind":"vulnerability","aliases":["CVE-2026-105044"],"related":[],"title":"Qingteng host security platform: admin can run OS commands on clients","description":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection","summary":"Security Toolbox in the Qingteng Host Adaptive Security Platform V3.0 does not neutralize special characters in a command, so OS command injection is possible. An authenticated console administrator can run arbitrary commands on every attached client host.","severity":"high","cvss":8.5,"epss":0.00936,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["host-monitoring","infrastructure","qingteng","self-hosted"],"not_affected_if":["not-qingteng-platform","patched-toolbox"],"how_to_check":"- unknown","fix":"- Upgrade Security Toolbox to version `20260929` or later, per the sources.","status":"open","published_at":"2026-10-21T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:00:22+00:00","updated_at":"2026-10-25T03:00:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:00:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Security Toolbox to version `20260929` or later, per the sources.","reach":"network","title":"Qingteng host security platform: admin can run OS commands on clients","impact":"high","summary":"Security Toolbox in the Qingteng Host Adaptive Security Platform V3.0 does not neutralize special characters in a command, so OS command injection is possible. An authenticated console administrator can run arbitrary commands on every attached client host.","category":"infrastructure","nicknames":[],"who_cares":["qingteng","host-monitoring","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Arbitrary commands run on every attached client host.","analyst_note":"Confirm the affected version range and the fixed build from the vendor advisory; the NVD entry gives only 'before 20260929'.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-qingteng-platform","patched-toolbox"],"who_is_affected":"Teams running the Qingteng Host Adaptive Security Platform V3.0 (Host Monitoring) with Security Toolbox older than `20260929` are affected. The attacker needs an administrator account on the platform console, and the impact reaches the client hosts the console manages. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000579,"input_tokens":3359,"output_tokens":487,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105044':14A,17A '-2026':13A,16A '20260929':78C 'adapt':32B,82C 'admin':5A 'administr':53B,92C 'allow':88C 'arbitrari':56B,95C 'attach':60B,98C 'authent':51B,90C 'charact':40B 'client':11A,61B,99C 'command':9A,43B,46B,57B,72C,96C,102C 'consol':52B,91C 'cve':12A,15A 'element':67C 'everi':59B 'execut':94C 'host':2A,19B,25B,31B,62B,81C,85C 'host-monitor':18B 'improp':63C 'infrastructur':21B 'inject':47B,103C 'monitor':20B,86C 'neutral':38B,64C 'os':8A,45B,71C,101C 'platform':4A,34B,84C 'possibl':49B 'qingteng':1A,22B,30B,80C 'run':7A,55B 'secur':3A,26B,33B,74C,83C 'self':24B 'self-host':23B 'special':39B,66C 'toolbox':27B,75C 'use':68C 'v3.0':35B,87C 'version':76C 'via':100C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Qingteng Host Adaptive Security Platform V3.0 (Host Monitoring) with Security Toolbox older than `20260929` are affected. The attacker needs an administrator account on the platform console, and the impact reaches the client hosts the console manages. Teams not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mandiant-cve@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105044","severity":null,"published_at":"2026-10-21T01:17:19+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105044","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105044","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}