Unpatched Kaltura mw Embed Flaws Could Let Remote Attackers Read Files and Run Code

Summary: CERT/CC disclosed two unpatched vulnerabilities, CVE-2026-19913 and CVE-2026-19912, in Kaltura's mwEmbed HTML5 player library, both stemming from unsafe deserialization in the mwEmbedLoader.php endpoint that lets a remote, unauthenticated attacker read arbitrary files and execute code. CERT/CC said it was unable to reach Kaltura to coordinate, no patch is available, and the endpoint is exposed on Kaltura's shared multi-tenant CDN infrastructure as well as customer installations.
What's compelling: The file-read flaw can pull /opt/kaltura/app/configurations/local.ini, which holds plaintext database connection strings and admin and console passwords, and because the endpoint sits on shared multi-tenant hosts, every tenant served by them is exposed, not just the installation that gets attacked.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-19912 CVE-2026-19913
Related: ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026