CVE Intelligence
Analysis AI-assisted

CVE-2026-24871: Minecraft-Rcon-Manage Code Injection (CWE-94),

CVE-2026-24871 is a code injection weakness (CWE-94) in the Minecraft-Rcon-Manage project by pilgrimage233, affecting versions before 3.0. The CNA cve_disclosure@tech.gov.sg scored it 10 under CVSS v4.0 with critical severity. No confirmed exploitation appears in the sources consulted, and the record lists no structured fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24871 is a code injection weakness (CWE-94) reported in the Minecraft-Rcon-Manage project by pilgrimage233. According to the CVE record, the issue affects versions before 3.0. The record was published on 2026-01-27 by the CNA cve_disclosure@tech.gov.sg, and its source status is Deferred.

Impact

The CNA scored the issue 10 under CVSS v4.0, which corresponds to a critical rating. The vector in the record indicates a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability of the vulnerable system and of subsequent systems. Code injection flaws allow input to be interpreted as code, so the practical consequences depend on how the project handles input, which the record does not describe.

Affected products and versions

  • Product: Minecraft-Rcon-Manage by pilgrimage233
  • Range stated in the record: before 3.0
  • The record contains no structured list of affected or fixed versions.

Exploitation status

  • The CISA KEV catalog does not list this CVE.
  • No confirmed exploitation appears in the sources consulted.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Identify every deployment of Minecraft-Rcon-Manage and record its version.
  • Plan an upgrade to version 3.0 or later, since the stated range ends before 3.0. Confirm the fixed release against the project's own release notes, because the record does not name one.
  • Restrict network exposure of any management interface and limit access to trusted administrators.
  • Review the referenced pull request for context on the change.

Detection guidance

  • Review logs of the management component for unexpected administrative actions or unusual input patterns.
  • Watch hosts running the tool for unexpected processes, configuration changes or file modifications.

Limitations of the available information

  • The record has no vendor advisory, no structured affected or fixed version list, no exploitation data, no EPSS and no SSVC assessment.
  • It is unknown whether the referenced pull request is the actual fix.
  • The vulnerable component and the input path are not described.

Frequently asked questions

What is CVE-2026-24871?

It is a code injection weakness (CWE-94) in the Minecraft-Rcon-Manage project by pilgrimage233, affecting versions before 3.0 according to the CVE record.

Is this vulnerability being exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Identify deployments, plan an upgrade to version 3.0 or later after confirming the fixed release with the project, and restrict network exposure of management interfaces.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.