Kaltura mwEmbed / html5lib Insecure Deserialization — CVE-2026-19913 & CVE-2026-19912

CVE-2026-19913 (arbitrary file read) and CVE-2026-19912 (remote code execution) are two unpatched vulnerabilities in Kaltura's HTML5 player library — distributed as mwEmbed and also as html5lib — disclosed by CERT/CC as VU#308749 on 2026-08-25 (Original Release Date / Date Public / Date First Published, per the CERT/CC note itself) and covered by The Hacker News on 2026-08-26. Both flaws trace to the same root cause: the mwEmbedLoader.php endpoint accepts a user-controlled ServiceUrl parameter that Kaltura's KalturaClientBase PHP client fetches and passes directly to PHP's unserialize() — without validating scheme, source, or content.

CVE-2026-19913 abuses that flaw plus an error-handling bug: pointing ServiceUrl at a file:// path causes the client to fetch a local file and attempt to deserialize it; when deserialization fails, the raw file bytes are reflected back in the error message. Researcher Gerjan Wemekamp (AndDone) demonstrated escalating this to read /opt/kaltura/app/configurations/local.ini — which CERT/CC's advisory says can hold database credentials, admin/console passwords, and API keys. CVE-2026-19912 chains the same deserialization with insufficient sanitization of the uiconf_id parameter, which is appended unsanitized to the base cache-folder path when the application writes to disk: a uiconf_id containing ../ traversal sequences can redirect a malicious-serialized-object write into a web-accessible directory, and requesting that file directly executes it as the web-server user — full remote code execution, no authentication, no session token, network reachability only.

No patch exists. CERT/CC states it "was unable to reach Kaltura to coordinate these vulnerabilities." Both CVEs affect html5lib v2.45, v2.103, and earlier, plus other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Because the endpoint is also exposed on Kaltura's own shared, multi-tenant CDN infrastructure, CERT/CC notes the blast radius extends beyond individual self-hosted installs to every tenant served by those shared hosts. Neither CVE carried a CERT/CC-assigned CVSS score at publish time; the reporter self-scored CVE-2026-19912 at 10.0 and CVE-2026-19913 at 9.1 in his own technical writeup (reporter-assigned, not vendor- or CERT/CC-confirmed). Neither CVE appeared in the CISA KEV catalog as of 2026-08-25 per The Hacker News, and no confirmed in-the-wild exploitation has been reported — this pack treats it as a fresh, high-severity disclosure, not an active campaign.

Defender priority: until a patch ships, CERT/CC's own guidance is the fastest real mitigation: restrict or disable external access to mwEmbedLoader.php and enforce a strict allow-list on ServiceUrl that permits only known, legitimate backend API URLs and rejects non-HTTP(S) schemes. This pack ships behavioral, process/file/network-lineage CQL for the RCE half of the chain plus network/proxy-layer log queries for the file-read half — but the actual highest-confidence signal for CVE-2026-19913 (a request containing ServiceUrl=file://) and for the resulting exposure lives in web/proxy/WAF request logs, which are not default Falcon EDR sensor telemetry. If those logs are not ingested into a SIEM, your first real control is the network-layer restriction, not a detection query.

Three sources were fetched directly (via curl) and snapshotted verbatim to Kaltura-mwEmbed-CVE-2026-19913-19912-Hunt-sources/. Every fact and behavioral indicator shipped in this pack traces to one of those three snapshots. A fourth optional corroboration source named in the task brief was not needed beyond the three fetched — all three returned HTTP 200 on the first attempt.

Research notes and deliberate exclusions

• Date reconciliation: the task brief that seeded this pack described the CERT/CC disclosure date as 2026-08-26. The CERT/CC note itself states Original Release Date, Date Public, and Date First Published as 2026-08-25; The Hacker News' article carries a 2026-08-26 byline. This pack follows the source-verified 2026-08-25 CERT/CC publish date for the disclosure itself and treats 2026-08-26 as the date of THN's follow-on press coverage, rather than restating the brief's date uncritically.
• No atomic IOCs are shipped. This is a logic/deserialization vulnerability in first-party vendor code, not malware with attacker-controlled infrastructure, and no source reviewed reports in-the-wild exploitation. No file hashes, C2 domains, or IPv4 addresses are shipped — Section 4 and Section 10 reflect that honestly.
• No working exploit chain is reproduced. The vulnerability mechanism is described only at the depth needed for detection engineering. The researcher's own technical writeup (referenced by CERT/CC and named by The Hacker News as anddone-git.github.io) was deliberately not fetched for this pack, since a step-by-step PoC write-up is out of scope for a defensive-only deliverable.
• Reporter-assigned CVSS scores (10.0 / 9.1) are explicitly attributed as such, not presented as CERT/CC- or NVD-confirmed. Neither CVE had an NVD record as of 2026-08-25 per The Hacker News, which also reports NIST's April 2026 statement that it no longer enriches every CVE.
• Treat-as-data check: none of the three fetched pages contained text directed at the assistant (no "ignore previous instructions," no claimed authority, no embedded directives of any kind). All three were read and used purely as source data for this pack.

Hunt hypotheses (ordered by fidelity)

Attack chain

CVE-2026-19913 and CVE-2026-19912 are vendor-code logic/deserialization flaws with no reported in-the-wild exploitation as of this pack's build date. No source reviewed publishes attacker infrastructure. The table below reflects that honestly — see Section 10 for the corresponding Behavioral Signatures quick-copy block.

The highest-confidence evidence for the file-read half of this chain lives in web/proxy/WAF logs, not EDR telemetry. Run these in parallel with, and ahead of, the CQL hunts in Section 8.

• Kaltura / PHP-FPM / Apache / nginx access log — grep or SIEM-search for the literal string ServiceUrl=file (fanged or percent-encoded, file%3A%2F%2F) in requests to mwEmbedLoader.php, especially from source IPs with no prior legitimate session.
• Same access log — grep for uiconf_id parameter values containing ../, ..%2f, or an absolute path (leading /).
• Web-server error log — unusually large or malformed deserialization-failure error responses from mwEmbedLoader.php; these are the mechanism by which CVE-2026-19913 reflects file content.
• File-integrity monitoring on local.ini and equivalent config files — unexpected reads (if FIM/audit logging is available) or, more practically, treat any suspected exposure as requiring full credential rotation regardless of confirmed read (Section 14).
• Cache-directory listing review — periodically diff the Kaltura cache directory tree against a known-good baseline; any .php file appearing outside expected cache-object naming, or any path containing traversal-shaped fragments, is consistent with the CVE-2026-19912 write primitive.
• Software/version inventory — reconcile every Kaltura / mwEmbed / html5lib deployment against the affected-version list (v2.45, v2.103, and earlier v2.x). See Playbook 1.
• Cache-backend configuration review — confirm whether the deployment uses the default file-based cache backend (vulnerable to the CVE-2026-19912 write-then-execute chain) or a memcache-only backend (per CERT/CC, this may suppress the specific file-write RCE path, though the underlying deserialization and unsanitized path construction remain present regardless).

No query in this pack is a clean Block-mode Custom IOA candidate. Q1 and Q6 are log queries (Falcon Next-Gen SIEM Scheduled Search), not sensor-based behavior — Custom IOAs are endpoint-sensor rules and do not apply to ingested HTTP logs. Q2 and Q3 have workable confidence but medium FP from legitimate Kaltura internals; Q4 and Q5 carry high FP and are investigate-only.

Alert email package — Q1 (primary detection)

Scheduled Search name: DETECT — Kaltura mwEmbedLoader.php ServiceUrl=file:// Abuse (CVE-2026-19913 / CVE-2026-19912)

Description: Fires when the literal parameter ServiceUrl=file:// (fanged or percent-encoded) appears in ingested Kaltura, reverse-proxy, or WAF HTTP request logs against mwEmbedLoader.php — the primary indicator of a probe or active exploitation attempt against the unauthenticated, unpatched CVE-2026-19913/CVE-2026-19912 deserialization chain.

Alert email subject: [CRITICAL] Detection: Kaltura CVE-2026-19913/19912 — ServiceUrl=file:// observed against mwEmbedLoader.php

Alert email body:
------------------------------------------------------------
A request containing "ServiceUrl=file://" was observed against
mwEmbedLoader.php on {{ host }} from source {{ src_ip }} at {{ @timestamp }}.

This string is the primary exploitation indicator for CVE-2026-19913
(unauthenticated arbitrary file read) and the shared entry point for
CVE-2026-19912 (unauthenticated RCE) in Kaltura's mwEmbed / html5lib
player library. NO PATCH IS AVAILABLE. CERT/CC (VU#308749) states it
was unable to reach Kaltura to coordinate these vulnerabilities.

IMMEDIATE ACTIONS:
  1. Confirm whether external access to mwEmbedLoader.php is currently
     restricted (Playbook 2). If not, restrict it NOW -- this is the
     single most effective control available with no vendor patch.
  2. Check web-server error logs around this timestamp for large or
     malformed deserialization-failure responses (Q6) that would
     indicate a file was actually reflected back to the requester.
  3. Treat this instance's local.ini (and equivalent secrets files) as
     POSSIBLY EXPOSED regardless of confirmed read -- begin credential
     rotation (Playbook / Containment runbook Phase 4).
  4. Pull the same host's process telemetry (Q2, Q3) for the following
     24h for signs the attacker progressed to the CVE-2026-19912 RCE
     chain (cache-directory write, then execution).
  5. Do NOT assume a single request is "just a scan" -- this endpoint
     requires no authentication and no user interaction to exploit.

ESCALATION: Platform/Infra on-call -> Security IR lead if step 4 finds
any corresponding process or file-write hit.
------------------------------------------------------------

Triage checklist

1. Confirm the alerting request actually targeted mwEmbedLoader.php and that ServiceUrl genuinely carries a file:// (or percent-encoded equivalent) value, not an unrelated field that happens to contain the string.
2. Identify the source IP — is it a known vulnerability scanner or your own exposure-check tooling (Playbook 1)? If so, close as benign and add to the Q1 TUNING exclusion.
3. Check whether external access to mwEmbedLoader.php is currently restricted (Playbook 2/3). If not, this is a live exposure regardless of whether this specific request succeeded.
4. Pull Q6 for the same host/window — a 5xx response alongside the Q1 hit raises confidence that content was actually reflected.
5. Pull Q2 and Q3 for the same ComputerName over the following 24 hours to check for progression to the CVE-2026-19912 RCE chain.
6. If any progression indicator is found, escalate to Security IR immediately — this is a confirmed exploitation attempt, not a probe.
7. Regardless of confirmed impact, begin the local.ini (and equivalent secrets) rotation checklist (Section 10, audit block) — the file-read primitive leaves no reliable endpoint trace of what was actually read.
8. Restrict mwEmbedLoader.php and enforce the ServiceUrl allow-list immediately if not already done (Playbooks 2/3).

Pivot queries

Host-scoped: re-run Q2 and Q3 scoped to the same ComputerName as the alerting Kaltura instance, over the 24 hours following the Q1 hit, to check for progression to the documented RCE chain.

Environment-wide: run Q1 across all ingested Kaltura instances for the last 30 days (extend the console time picker) to check for earlier, previously undetected probing that predates this alert.

IOC blocklist entries: not applicable — this vulnerability class has no published atomic indicators to block (see Section 4).

Hunt package — Q3 (investigate-only, secondary)

Q3's medium FP means it should not alert unattended. Run it manually against any host that also produced a Q1 hit, or periodically as a hygiene sweep against your cache-directory tree. Pivot: correlate any hit against Q2 (same host/window) — a webshell-style file write alongside an unexpected shell child materially raises confidence over either signal alone.

# CVE-2026-19913 and CVE-2026-19912 are logic/deserialization flaws in
# first-party Kaltura code, not malware with attacker-controlled
# infrastructure. No file hashes, C2 domains, or IPv4 addresses have been
# published by any source reviewed for this pack, and no in-the-wild
# exploitation has been reported -- shipping fabricated atomic IOCs here
# would fail this pack's own provenance gate.
#
# Track the vulnerability instead by:
#   CVE IDs:            CVE-2026-19913 (file read), CVE-2026-19912 (RCE)
#   CERT/CC ID:          VU#308749
#   Reporter scores:     10.0 (RCE) / 9.1 (file read) -- reporter-assigned,
#                         not CERT/CC- or NVD-confirmed
#   Affected:            html5lib v2.45, v2.103, and earlier v2.x releases
#                         exposing mwEmbedLoader.php
#
# If your own incident response later recovers attacker infrastructure
# (source IPs, follow-on payload hashes, etc.) from a CONFIRMED
# compromise, add rows here in standard
# type,value,action,severity,expiration,description,tags form and re-run
# check_ioc_provenance.py against a newly saved source snapshot.

# CVE-2026-19913 / CVE-2026-19912 behavioral signatures (no atomic IOC form)
# Exploitation indicators (request-layer)
Parameter string in request: ServiceUrl=file://  (or file%3A%2F%2F)
Parameter values containing traversal: uiconf_id=..%2f.. / uiconf_id=../..
Target endpoint: mwEmbedLoader.php
Requires: NO authentication, NO session token, network reachability only
# Response-layer signal
Anomalous 5xx / oversized error response from mwEmbedLoader.php
  (possible local-file-content reflection)
# Endpoint/process chain (RCE half, CVE-2026-19912)
Kaltura web-server process (php-fpm/php-cgi/apache2/httpd/nginx)
  spawning bash/dash/zsh/sh/python/perl/nc/ncat/socat/curl/wget
New executable or script written under a Kaltura cache path containing
  ../ traversal sequences or an unusual uiconf_id-shaped filename
Outbound connection or DNS resolution from the web-server process
  shortly after such a write (webshell check-in pattern)
# Sensitive file example (from researcher's demonstrated read, per THN)
/opt/kaltura/app/configurations/local.ini

CVE (file read):  CVE-2026-19913 -- reporter-scored 9.1 (not CERT/CC-confirmed)
CVE (RCE):        CVE-2026-19912 -- reporter-scored 10.0 (not CERT/CC-confirmed)
CERT/CC ID:       VU#308749 -- Original Release / Date Public / Date First
                  Published: 2026-08-25
Vendor:           Kaltura -- product: mwEmbed player library, also
                  distributed as html5lib
Affected:         html5lib v2.45, v2.103, and earlier v2.x releases
                  exposing mwEmbedLoader.php
Patch status:     NONE AVAILABLE -- CERT/CC states it was unable to
                  reach Kaltura to coordinate
Reporter:         Gerjan Wemekamp (AndDone)
Vendor status:    Unknown -- no statement received (per CERT/CC vendor table)
KEV status:       Not listed in CISA KEV as of 2026-08-25 (per The
                  Hacker News); not independently re-verified for this
                  pack -- validate directly before citing KEV status
Vulnerable file:  deployment/uiconf/KalturaClientBase.php (unserialize()
                  call site, per The Hacker News' code-history analysis)

# Exposure and hardening audit -- run against every Kaltura / mwEmbed /
# html5lib deployment
[ ] Confirm html5lib version and whether mwEmbedLoader.php is reachable
    externally (Playbook 1)
[ ] If reachable and unpatched: restrict/disable external access to
    mwEmbedLoader.php NOW (Playbook 2)
[ ] Confirm a ServiceUrl allow-list is enforced, rejecting non-HTTP(S)
    schemes (file://, php://, etc.) (Playbook 3)
[ ] Confirm uiconf_id values containing traversal sequences or absolute
    paths are rejected at the edge (Playbook 4)
[ ] Confirm the cache directory denies PHP execution (Playbook 4)
[ ] Confirm outbound network access from the application server is
    restricted to known-necessary destinations
[ ] Rotate everything in local.ini (and equivalent) where the endpoint
    has been externally exposed: DB credentials, admin/console
    passwords, partner secrets, API keys
[ ] Confirm whether the cache backend is file-based (vulnerable to the
    CVE-2026-19912 write-then-execute path) or memcache-only

Import note: this pack ships no rows for Falcon IOC Management by design (see the CSV block above). The importable content here is procedural (exposure/hardening audit) and behavioral, not atomic threat infrastructure.

Gate 1 — Telemetry ready

• Q1 and Q6 require log ingestion that most tenants do not have by default. Before treating a zero-hit Q1 result as "clean," confirm Kaltura/reverse-proxy/WAF request-and-response logs are actually flowing into Falcon NG-SIEM (or wherever Q1/Q6 run) — a zero-hit result against an empty log source is not a clean bill of health, it's a blind spot.
• Confirm ProcessRollup2/SyntheticProcessRollup2 and NewExecutableWritten/ELFFileWritten are populated for your Kaltura web-server host(s) specifically (typically Linux hosts, not just Windows fleet defaults).
• Confirm NetworkConnectIP4/DnsRequest coverage on the same host set before relying on Q4/Q5.

Gate 2 — Benign baseline

• Run Q2, Q3, Q4, and Q5 over 7 days with no exclusions and record hit counts before promoting any to Monitor mode. Expect Q4 and Q5 to be noisy — that noise is the baseline you tune against, not a false alarm to dismiss.
• Q1 and Q6 should return zero in a clean environment absent scanning activity; a non-zero baseline needs individual triage (Section 9 triage checklist), not blanket suppression.

Gate 3 — Positive tests

• In a non-production log source, submit a benign test log line containing the literal string ServiceUrl=file:// against a synthetic mwEmbedLoader.php URL and confirm Q1 fires end-to-end (ingestion → search → alert). Do not send this against a live, reachable Kaltura instance — inject the test event directly into the log pipeline.
• On a lab host, manually spawn a shell from a process named like one of the Q2 parent patterns (e.g. a test script invoked as php-fpm) and confirm Q2 fires; clean up afterward.

Gate 4 — Promotion criteria

• Q1 promotes to an active Scheduled Search alert only after Gate 1 (telemetry confirmed present) and Gate 3 (positive test fired) both pass.
• Q2/Q3 promote from Monitor to Alert only after 7+ days at a stable, explained baseline (Gate 2) with your Kaltura-internal exclusions applied.
• Do not promote Q4, Q5, or Q6 to alerting in this release — they remain investigate-only pending environment-specific tuning and correlation with Q1/Q2/Q3.

1 — Exposure & vulnerable-file audit (shell, read-only, no exploit payload)

# Reachability check ONLY -- no ServiceUrl / uiconf_id payload is sent.
# Confirms whether the endpoint answers at all; does not probe the flaw.
curl -s -o /dev/null -w "%{http_code}\n" \
  "https://REPLACE_WITH_KALTURA_HOST/REPLACE_WITH_MWEMBED_PATH/mwEmbedLoader.php"

# On the Kaltura host itself -- confirm the vulnerable client library file
# is present and note its version context (read-only; no code is modified).
grep -n "unserialize(" REPLACE_WITH_KALTURA_ROOT/deployment/uiconf/KalturaClientBase.php

# Confirm the html5lib / mwEmbed component version against the affected list:
#   Affected: v2.45, v2.103, and earlier v2.x releases exposing mwEmbedLoader.php
grep -ri "version" REPLACE_WITH_KALTURA_ROOT/REPLACE_WITH_HTML5LIB_PATH/*.json 2>/dev/null

Prerequisites: network line-of-sight to the endpoint for the reachability check; SSH/read access to the Kaltura host for the file checks. Reboot required: no (read-only checks). Rollback: none required — this playbook sends no exploit payload and modifies nothing.

2 — Restrict external access to mwEmbedLoader.php (nginx, reverse proxy)

# /etc/nginx/conf.d/kaltura-mwembedloader-restrict.conf
# Place inside (or alongside) the existing Kaltura/reverse-proxy server block,
# then reload. Adjust the allowed ranges to your actual internal/CI/CD needs.
location ~* /mwEmbedLoader\.php$ {
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    deny all;
}

sudo nginx -t && sudo nginx -s reload

Prerequisites: nginx (or equivalent reverse proxy) terminating in front of the Kaltura deployment; admin access to edit its config. Reboot required: no. Rollback: remove the location ~* /mwEmbedLoader\.php$ block from the config file, then run sudo nginx -t && sudo nginx -s reload again. Note: if the player is actively served to the public internet, disabling this path may break embedded video playback for external viewers until a patch or a scoped allow-list (Playbook 3) is in place.

3 — ServiceUrl allow-list, reject non-HTTP(S) schemes (ModSecurity example)

# /etc/modsecurity.d/kaltura-cve-2026-19913-servicurl-allowlist.conf
# Rejects any ServiceUrl value that is not http:// or https:// pointed at
# the deployment's own known API host. Adjust REPLACE_WITH_KALTURA_API_HOST
# to your environment's actual backend API hostname.
SecRule ARGS:ServiceUrl "!@rx ^https?://REPLACE_WITH_KALTURA_API_HOST/" \
    "id:1000019913,phase:2,deny,log,msg:'Blocked disallowed ServiceUrl value (CVE-2026-19913/19912 compensating control)'"

sudo apachectl configtest && sudo systemctl reload apache2
# or, for an nginx+ModSecurity install:
sudo nginx -t && sudo nginx -s reload

Prerequisites: ModSecurity (or an equivalent WAF engine) in the request path in front of Kaltura, with request-parameter inspection enabled. Reboot required: no (WAF config reload only). Rollback: remove or disable rule id 1000019913 and reload the WAF engine. This is a temporary compensating control — retire it once a vendor patch is available and deployed.

4 — Reject uiconf_id traversal and deny PHP execution in cache directories

# /etc/modsecurity.d/kaltura-cve-2026-19912-uiconfid-traversal.conf
SecRule ARGS:uiconf_id "@rx (\.\.[\\/]|^[\\/]|%2e%2e)" \
    "id:1000019912,phase:2,deny,log,msg:'Blocked uiconf_id path traversal attempt (CVE-2026-19912 compensating control)'"

# nginx: deny PHP execution inside the Kaltura cache directory tree so
# even a successfully-planted file cannot be executed. Adjust the path
# to your actual cache root.
location ~* ^/REPLACE_WITH_KALTURA_CACHE_PATH/.*\.php$ {
    deny all;
    return 403;
}

sudo apachectl configtest && sudo systemctl reload apache2
sudo nginx -t && sudo nginx -s reload

Prerequisites: ModSecurity (or equivalent WAF) for the uiconf_id rule; nginx (or equivalent) location-block support for the cache-directory PHP-execution denial; admin access to both. Reboot required: no (config reload only). Rollback: remove rule id 1000019912 and the cache-directory location block, then reload both services. Test the cache-directory denial in a staging environment first — confirm no legitimate cache path legitimately requires PHP execution before deploying to production.

This pack's most important honesty point is here: the file-read half of this vulnerability class (CVE-2026-19913, T1005/T1552.001) has essentially zero Falcon EDR coverage, because it is a network-request-and-response-layer flaw, not an endpoint compromise, until an attacker progresses to the RCE half. Detection depends entirely on ingesting Kaltura/proxy/WAF logs into a SIEM (Q1, Q6). The endpoint-telemetry queries (Q2–Q5) cover the documented CVE-2026-19912 RCE chain once execution has already begun — they are not early-warning for the file-read primitive by themselves. Clear Gate 1 in Section 11 — especially the log-ingestion prerequisite — before treating a zero-hit Q1 result as a clean bill of health.

Provenance: the fetched text of all three sources is saved alongside this pack in Kaltura-mwEmbed-CVE-2026-19913-19912-Hunt-sources/. This pack ships no atomic file/network IOCs, so the provenance gate (check_ioc_provenance.py) has nothing to trace and passes vacuously — every factual claim in this pack is nonetheless attributable to one of the three numbered sources above.

Unresolved gaps: neither CVE had a CERT/CC- or NVD-assigned CVSS score as of the sources fetched for this pack (reporter self-scored only). CISA KEV listing status was reported by The Hacker News as "not listed as of 2026-08-25" but was not independently re-fetched from cisa.gov for this pack — validate directly at cisa.gov/known-exploited-vulnerabilities-catalog before citing KEV status in a customer-facing document. The researcher's own technical writeup (referenced by CERT/CC, named by The Hacker News as hosted at anddone-git.github.io) was deliberately not fetched, since this pack is defensive-only and out of scope for reproducing exploit detail.