CVE-2020-35476: OpenTSDB yrange parameter command injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a 9.8 CVSS score and very high EPSS probability, with public exploit references available.

What it is

OpenTSDB through 2.4.0 writes the user-supplied yrange parameter into a gnuplot file under /tmp, which is then executed by the mygnuplot.sh shell script. The attempted backtick filter in tsd/GraphHandler.java is insufficient, so shell metacharacters in yrange lead to OS command injection. This matters because the endpoint is network-reachable and unauthenticated, giving full compromise of the OpenTSDB host.

Impact

An unauthenticated remote attacker can execute arbitrary OS commands with the privileges of the OpenTSDB process, leading to full host compromise, data theft, and use of the server as a pivot point.

Attack surface

Reached over the network through the graphing/query HTTP interface that accepts the yrange parameter; the CVSS vector shows no privileges or user interaction required. Any exposed OpenTSDB graphing endpoint is a candidate.

Exploitation

Not listed in CISA KEV, but EPSS is 0.8533 (99.7th percentile) and public references are tagged Exploit, indicating working exploit code is publicly available. No ransomware usage is documented.

What to do

• Upgrade OpenTSDB past 2.4.0 to a release that fixes the yrange command injection; if no fixed release is available, treat the graphing endpoint as untrusted.
• Restrict network access to the OpenTSDB HTTP/graphing interface with firewall rules or a reverse proxy, allowing only trusted management hosts.
• Run OpenTSDB as a dedicated low-privilege account with no shell and no access to sensitive files or the /tmp execution path.
• Sanitize or reject shell metacharacters in the yrange parameter at the proxy/WAF layer as a stopgap, and remove or disable the gnuplot execution path if graphing is not needed.
• Monitor and harden the /tmp directory (noexec where feasible) to limit execution of attacker-written gnuplot scripts.

Detection

• Inspect OpenTSDB HTTP access logs for requests with yrange values containing shell metacharacters such as ;, |, $(), or newlines.
• Monitor process creation on OpenTSDB hosts for child processes spawned by the Java service, especially gnuplot and shell interpreters.
• Watch for new or modified files in /tmp matching gnuplot script patterns and for execution of mygnuplot.sh.
• Alert on outbound network connections or unexpected command execution from the OpenTSDB service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.