Security

Security Advisories & Vulnerability Disclosures

Security guides how we design, build, test, and ship rConfig, from the first code change through to each release.

Why Security Matters in Network Configuration Management

In modern IT and OT environments, Network Configuration Management platforms sit directly inside the security perimeter. They control device access, store sensitive configuration data, and automate privileged operations across critical infrastructure.

rConfig plays a central role in helping network and security teams enforce policy, maintain compliance, and reduce risk, while protecting against unauthorized access, configuration drift, and compromise.

Security is not treated as a feature. It is embedded across our architecture, development lifecycle, testing processes, and release management.

Proven Beyond Doubt

We are proud to maintain a transparent and verifiable security history.

  • Zero reported vulnerabilities in rConfig since 2019
  • One historical advisory affecting v3.x only, responsibly disclosed and patched
  • All modern versions (V5+) are unaffected
  • Complete platform re-architecture since V5.x

Security by Design, Platform Safeguards

  • Role-Based Access Control (RBAC)

    Granular permissions per user, role, device, and action. Essential for multi-admin and regulated environments.

  • Secure API Endpoints

    Token-based authentication, HTTPS-only, optional IP allow-listing, and role-scoped API tokens.

  • Automated Vulnerability Scanning

    Dependency scanning (OWASP, GitHub advisories), static code analysis, and continuous CI/CD enforcement.

  • 5,700+ Tests in the Product Suite

    Unit tests, feature tests, integration & API tests, and regression coverage.

Published Security Advisories

One advisory is currently open: a critical vulnerability in the PHP runtime that rConfig runs on. Our assessment of rConfig is under way.

  • Date
    2026-10-20
    Advisory ID
    Affected Version
    V5 to V8 (under assessment)
    CVE Reference
    CVE-2026-109618, CVE-2026-109619
    Status
    Investigating
  • Date
    2019-07-10
    Advisory ID
    rCFG-SA-2019-01
    Affected Version
    v3.x
    CVE Reference
    CVE-2023-39110
    Status
    Resolved
Published security advisories
DateAdvisory IDAffected VersionCVE ReferenceStatus
2026-10-20rCFG-SA-2026-01V5 to V8 (under assessment)CVE-2026-109618, CVE-2026-109619Investigating
2019-07-10rCFG-SA-2019-01v3.xCVE-2023-39110Resolved

* The 2019 advisory affected v3.x only. The status of V5+ for the 2026 PHP advisory is under assessment.

Responsible Disclosure Policy

We actively encourage responsible disclosure from security researchers, customers, and community contributors.

Reporting Instructions

Email

security@rconfig.com

Please include:

  • Detailed description
  • Steps to reproduce
  • Affected versions
  • Contact details

Our Commitments

  • Acknowledgement within 48 hours
  • Transparent communication
  • Coordinated remediation
  • Public disclosure when appropriate

We may offer Hall of Fame recognition or additional rewards depending on severity and impact.

External Resources & Best Practices

  • No current vulnerabilities in rConfig versions 5, 6, 7 and 8
  • Last advisory resolved in 2019 (v3.x only)
  • Secure Laravel core & hardened API architecture
  • Continuous automated testing & scanning
  • Responsible disclosure guaranteed

Security You Can Trust, Transparency You Can Verify