(english only)
Dear openITCOCKPIT Community,
Some of your systems are currently under maintenance.
During this period, some of our systems may be temporarily unavailable. The affected services include:
A new security vulnerability has been discovered in the brotli library, which implements a compression algorithm used by several programming languages and software projects, including NodeJS. The vulnerability has been assigned CVE-2026-111497 and affects multiple versions of the brotli library. We recommend updating all affected software to the latest versions that include the security fix.
The vulnerability was fixed in NodeJS 24.22.1, released on October 21, 2026.
The good news: openITCOCKPIT 5.9.0 is not affected by this vulnerability. It was built and released on October 22, 2026, and already includes NodeJS 24.22.1 with the security fix.
If you are using openITCOCKPIT 5.9.0 or later, your system should already include the patched version. To verify this, run the following command:
docker exec -it openitcockpit-node node --version
The output should show v24.22.1 or later, indicating that your system includes the patched version of NodeJS.
For example:
[Ubuntu][08:47]root@openitcockpit-node~# docker exec -it openitcockpit-node node --version
v24.22.1
If you see an older version, update your openITCOCKPIT installation. If this does not resolve the issue, please contact us immediately.
If you are running the Docker version of openITCOCKPIT, first run docker ps to identify the Puppeteer container. Its name should be similar to openitcockpit-ce-docker-puppeteer-1.
Then check the NodeJS version inside the container by running:
docker exec -it openitcockpit-ce-docker-puppeteer-1 node --version
The output should also show v24.22.1 or later, confirming that the container includes a patched version of NodeJS.
openITCOCKPIT uses a tool called Puppeteer to generate PDF files. Puppeteer requires NodeJS to run. openITCOCKPIT does not install NodeJS directly on the host system.
Instead, it ships a Docker container (openitcockpit-node) that includes NodeJS and all the dependencies needed to run Puppeteer.
The openitcockpit-node container listens only on 127.0.0.1:7084, so it is not reachable from outside the openITCOCKPIT server itself.
The openITCOCKPIT Monitoring Agent 3.7 is the biggest update of the agent for a long time. It adds 19 new checks: logfiles and certificates, hardware monitoring through IPMI and Redfish, ZFS, Ceph and Proxmox VE, mail queues, security features of the operating systems and many Windows specific checks. In addition, a lot of work went into stability, performance and the software inventory.
All new checks are available for the agent in pull and push mode and come with matching service templates in openITCOCKPIT, so they can be created with a few clicks in the agent wizard (requires openITCOCKPIT 5.9.0).
openITCOCKPIT version 5.9.0 has been released!
As mentioned in the PHP security advisories, there are critical vulnerabilities that need to be addressed immediately.
Patches are available for Ubuntu, Debian and RHEL. Please make sure to install the latest security updates as soon as possible.
Downtimes in openITCOCKPIT start and end at specific times, and have a fixed duration. How ever, a user may cancel a downtime, or it may start later than scheduled,
for example if a user schedule a downtime with a start date in the past, or in case the monitoring engine is not running at the scheduled start time.
While openITCOCKPIT tracks the schedule time and the actual time for a long time already, it never displayed the values to the user.
With this release, openITCOCKPIT will also show the actual start time, end time and the actual duration, in case it differs from the scheduled times.
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in PHP and should be addressed immediately by updating to the latest PHP version. Large parts of openITCOCKPIT are build using PHP, especially on the main server and satellite systems. Due to the two vulnerabilities are in the programming language itself, please see the official PHP security advisories for more information: