CVE-2026-38992 — Vulnerability in cockpit-hq/cockpit — CVE Details

CRITICAL

Cockpit is vulnerable to arbitrary code execution

Published April 29, 2026Updated May 6, 2026Source: osv

Summary

Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Advisory Timeline

First published April 29, 2026 (166 days ago).
Last revised May 6, 2026 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update cockpit-hq/cockpit to 2.14.0 or later

composer require "cockpit-hq/cockpit:^2.14.0"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
cockpit-hq/cockpit	packagist	2.0.0, 2.0.1, 2.0.2, 2.1.0 (+56 more)	2.14.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-38992?: Cockpit is vulnerable to arbitrary code execution This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-38992?: CVE-2026-38992 affects cockpit-hq/cockpit. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-38992 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-fm6c-rhcf-7439

Related CVEs

CVE-2026-107845
CRITICAL
Contao: Cross-site scripting in the comments bundle
CVE-2026-92161
CRITICAL
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
CVE-2024-4825
CRITICAL
Cockpit CMS contains an arbitrary file upload vulenrability
CVE-2023-4195
CRITICAL
Cockpit PHP Remote File Inclusion vulnerability
CVE-2026-38991
HIGH
Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies