# Kaltura's Video Engine Has Two Unpatched Holes — and Attackers Don't Need Credentials


Universities, corporate training platforms, and media companies running Kaltura's self-hosted video infrastructure should be concerned this week. The CERT Coordination Center has gone public with two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library that let anyone on the internet read files from the server and execute arbitrary code. No account required.


The timing matters: CERT/CC typically exhausts coordination options before publishing. The fact that these landed as unpatched disclosures suggests the vendor wasn't moving fast enough.


## The Technical Core


Both CVEs — CVE-2026-19913 (arbitrary file read) and CVE-2026-19912 (remote code execution) — trace back to the same root cause: unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player library.


That's one source, two catastrophic outcomes. The file read gives attackers a reconnaissance channel into server internals — config files, credentials, private keys, whatever lives on the filesystem and is accessible by the web server process. The RCE takes that further and lets them run commands. Together, these form a clean exploitation ladder: read the config to find credentials, then run code to pivot deeper.


PHP deserialization vulnerabilities are a well-understood class of bugs at this point. The unserialize() function in PHP will instantiate arbitrary objects from attacker-controlled input, and in any application with the right mix of classes loaded, an attacker can chain those objects into a working exploit — called a "gadget chain." Kaltura's player library apparently feeds user-controlled data into this mechanism without sanitizing it first.


The specific endpoint, mwEmbedLoader.php, is particularly problematic because it's meant to be publicly accessible — that's how video embeds work. There's no authentication layer sitting in front of it to raise the bar.


## Who's Actually Exposed


Kaltura's reach tends to be underestimated outside of EdTech circles. The platform is embedded across:


  • Higher education: Hundreds of universities run self-hosted Kaltura deployments for lecture capture, LMS integration, and student video submissions
  • Corporate L&D: Large enterprises use Kaltura for internal training libraries, often with SSO tied to Active Directory or LDAP
  • Media and broadcast: Regional media companies and studios use it as the plumbing behind video portals
  • Government agencies: Organizations that can't send video to commercial cloud providers often host Kaltura internally

    • The self-hosted nature of these deployments is what makes the vulnerability especially dangerous. Cloud-managed customers may get patched centrally, but on-premise operators are waiting on a patch that doesn't exist yet.


    ## No Patch, So What Do You Do


    Since Kaltura hasn't shipped a fix, defenders are working with network controls and workarounds — not a clean remediation path.


    Immediate steps worth taking:


  • WAF rules: Block or challenge requests to mwEmbedLoader.php that include serialized PHP data. Look for patterns like O:, ;, and } common in PHP object serialization syntax in POST bodies or query strings
  • Rate limiting: The file read vector almost certainly benefits from repeated probing — limit request rates to the affected endpoint
  • Filesystem hardening: Ensure the web server user has the minimum required filesystem permissions. If the web process can't read /etc/passwd or application config directories outside the webroot, you've reduced the impact of the file read primitive
  • Network segmentation: If your Kaltura deployment doesn't need to be internet-facing, restrict access to known IP ranges. Many enterprise and education deployments serve internal users only
  • Log monitoring: Watch mwEmbedLoader.php access logs for unusual traffic patterns, especially large POST requests or rapid sequential requests from single IPs

    • None of this is a fix. It's damage reduction while you wait.


    ## HackWire Analysis


    The Kaltura vulnerabilities land in an uncomfortable place in the vulnerability disclosure ecosystem: a widely-deployed platform, a critical flaw, and no patch at the time of public release. CERT/CC's decision to go public anyway is significant — they operate under a coordinated disclosure philosophy, and when they publish without vendor remediation, it usually means they've given the vendor substantial time and received either silence or inadequate response.


    This follows a pattern worth naming. Video infrastructure received massive investment during the 2020–2022 period when remote work and remote learning drove adoption at scale. Many organizations made quick deployment decisions and integrated video platforms deeply into their authentication infrastructure, content workflows, and LMS integrations. The security vetting didn't always keep pace with the deployment speed.


    What makes this particular disclosure more dangerous than a typical PHP bug is the combination of ubiquity and unauthenticated access. The mwEmbedLoader endpoint is designed to serve public embed requests — that's its job. There's no login gate in front of it, which means any internet scanner can probe for it and any exploit won't trip authentication anomaly detectors. Defenders watching for credential stuffing or brute force attempts will see nothing.


    The higher education sector specifically should treat this as a priority. Universities run some of the most exposed Kaltura instances — accessible to students, faculty, and often the open internet — and they frequently have limited security staff relative to the surface area they defend. An attacker with file-read access to a university Kaltura server could find credentials for database servers, SSO integrations, or file storage systems serving millions of student records.


    Keep monitoring CERT/CC's VU#896752 advisory for patch updates. The moment Kaltura releases a fix, deploy it immediately.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)