Kaltura Video Player Has Two Unpatched Bugs. One Gives Attackers RCE
- The Mess: Two vulnerabilities in Kaltura’s mwEmbed HTML5 video player, tracked as CVE-2026-19912 and CVE-2026-19913, can allow unauthenticated attackers to remotely execute code or read arbitrary files on vulnerable servers. There is still no official patch.
This isn’t a browser bug.
It’s server-side.
And that’s worse.
The vulnerable component is part of Kaltura’s mwEmbed video-player stack. Researchers found that the application uses unsafe deserialization in mwEmbedLoader.php.
That gives an attacker an interesting primitive:
Send malicious serialized data.
Get the server to process it.
Abuse the resulting object handling.
And potentially execute commands.
No valid account required.
No password.
No employee to trick.
Just network access to the vulnerable endpoint.
The two CVEs split the damage:
CVE-2026-19912 → Remote Code Execution
CVE-2026-19913 → Arbitrary File Read
That’s already bad.
Together, it’s the sort of combination defenders don’t want sitting on an Internet-facing server.
The file-read vulnerability can potentially expose configuration files and other sensitive information. Depending on the deployment, that can include credentials, API keys and other secrets that turn a file-read bug into the first step of a much larger attack.
And here’s the annoying part:
there is no vendor patch yet.
CERT/CC has published the vulnerability advisory, but the affected software remains unpatched at the time of publication.
Researchers estimate that hundreds of Internet-facing instances may be exposed.
That makes this less interesting as a theoretical PHP bug and much more interesting as an attack-surface problem.
- The Damage: An unauthenticated attacker could potentially read sensitive files or execute arbitrary commands on a vulnerable Kaltura server, exposing credentials and potentially turning the server into a foothold for further attacks.
The RCE is obviously the headline.
But don’t underestimate the file-read bug.
Attackers love credentials.
Configuration files can contain database passwords.
API tokens.
Cloud credentials.
Application secrets.
Internal service addresses.
Sometimes the most valuable thing on a compromised server isn’t the server itself.
It’s what the configuration file tells the attacker about everything else.
Once those credentials are stolen, the attacker doesn’t necessarily need to keep exploiting Kaltura.
They can simply move sideways.
And that’s where a seemingly isolated media-server vulnerability can become an infrastructure problem.
The lack of authentication makes the situation worse.
There’s no requirement to compromise a Kaltura account first.
No employee account.
No administrator password.
No session cookie.
The attack surface is exposed at the application layer.
- The Fix: There is currently no official patch, so identify exposed mwEmbed installations immediately, restrict access to vulnerable endpoints from the Internet, apply any vendor/CERT-recommended mitigations, and monitor logs for suspicious requests until a fixed release is available.
This is one of those situations where “wait for the patch” isn’t an acceptable strategy.
If you don’t need the vulnerable endpoint exposed publicly:
remove it from the Internet.
Put it behind a VPN.
Restrict it with firewall rules.
Use an application-layer security control where appropriate.
And start hunting.
Look for:
- suspicious POST requests,
- unusual serialized input,
- unexpected PHP processes,
- modified server files,
- outbound connections from the Kaltura host,
- newly created files,
- unexpected API calls,
- credentials or configuration files accessed in unusual ways.
If the server has been exposed for a long time, don’t assume the absence of an obvious compromise means nobody touched it.
Attackers don’t have to leave a ransomware note.
Sometimes they just steal the secrets and disappear.
Bugstoday Opinion
This one checks almost every box we care about.
Unauthenticated.
Remote.
RCE.
Arbitrary file read.
No official patch.
And it’s hiding inside something that sounds harmless:
a video player.
That’s the part worth remembering.
Attackers don’t care whether your server exists to deliver banking transactions, source code or cat videos.
If PHP is processing attacker-controlled input, it’s an attack surface.
And when researchers find unsafe deserialization in an Internet-facing component, pretending it’s “just a media application” is how incidents start.
Bugstoday verdict: Kaltura users have a problem — the bugs are public, the attack surface exists, and the official patch isn’t there yet. If you don’t absolutely need mwEmbed exposed to the Internet, get it behind a firewall now.
