GHSA-fm6c-rhcf-7439

ghsaUSosv

Cockpit is vulnerable to arbitrary code execution

view advisory published 2026-04-29Licence: CC-BY-4.0

Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-38992US	—	0.43% (37th)	—	2026-04-29
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system comman…

references

External citations — patches, advisories, analysis.

https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulnsWEB
https://github.com/Cockpit-HQ/CockpitPACKAGE
https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-38992ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan