Skip to content

Kaltura mwEmbed unpatched: unauthenticated file read + RCE via mwEmbedLoader.php (CVE-2026-19912/19913)

Summary

The CERT/CC disclosed on August 26, 2026 two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws — CVE-2026-19913 and CVE-2026-19912 — both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player library, which Kaltura also distributes as html5lib.

Key facts from the disclosure (via The Hacker News; the primary CERT/CC advisory was not reachable at scan time): - No authentication or Kaltura session token required. Network access to the endpoint is the only precondition. - No patch is available. CERT/CC said it was "unable to reach Kaltura to coordinate these vulnerabilities." - No exploitation had been reported at the time of writing; neither CVE appeared in CISA's Known Exploited Vulnerabilities catalog.

Tags

Technical detail

  • Sink: mwEmbedLoader.php in the mwEmbed player library — the loader that assembles the video-player runtime from server-side configuration.
  • Root cause (both CVEs): unsafe deserialization in that endpoint. One manifestation is arbitrary file read; the other is remote code execution. Both are reachable without any session or credentials.
  • Exposure shape: any deployment where the mwEmbed endpoint (or a page embedding it) is reachable from the internet is exposed. Video-player deployments are frequently behind only basic WAF rules because they are "just media," which is exactly why an unauthenticated deserialization sink in them is high-impact.

Mitigation (per CERT/CC, as reported)

Until a patch exists, administrators should: 1. Restrict or disable external access to the mwEmbedLoader.php endpoint (network-level controls, WAF rules, or pulling it out of public reach entirely if the player can be served a pre-rendered config). 2. Enforce a strict allow-list on the ServiceUrl parameter permitting only legitimate backend API URLs — this constrains what the loader will fetch and process, reducing the deserialization surface. 3. Track the two CVEs for a vendor fix; given CERT/CC could not reach Kaltura, assume a long unpatched window.

Why this matters

  • Unpatched + unauthenticated + no vendor contact is the highest-concern vulnerability triad. Video-platform backends are a common foothold in multi-tenant SaaS environments, and a loader endpoint that can read arbitrary files and execute code is a full-system compromise primitive for anyone who finds the URL.
  • Deserialization in content/loader endpoints is a recurring class (see recent waves in other media and CMS stacks); the ServiceUrl allow-list control is a reasonable, cheap mitigation while no patch exists.

Caveats

  • Details are based on The Hacker News's August 26, 2026 report of the CERT/CC disclosure; the CERT/CC primary advisory and Kaltura's advisory page were not reachable at scan time (403 / DNS failure respectively).
  • No public exploit code or in-the-wild exploitation was reported at publication.

Sources