CVE-2026-38992: Cockpit Arbitrary Code Execution Vulnerability
Summary
CVE-2026-38992: Cockpit is vulnerable to arbitrary code execution. Affects cockpit-hq/cockpit versions < 2.14.0. Fixed in 2.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit is an open-source server management interface that allows users to administer their servers through a web-based graphical interface. It provides functionalities such as monitoring system performance, managing services, and configuring network settings. However, versions 2.13.5 and earlier are susceptible to a critical vulnerability that could allow unauthorized users to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability arises from improper handling of the filter parameter in multiple endpoints within Cockpit. An attacker can exploit this flaw by utilizing the MongoLite $func operator to run arbitrary system commands on the underlying infrastructure. This could lead to severe consequences, including unauthorized access to sensitive data, system compromise, and potential disruption of services. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
2.14.0
This is the first release that contains the fix.
composer require cockpit-hq/cockpit:2.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, consider restricting access to the affected endpoints or implementing network-level security controls to limit exposure to potential attackers.
Conclusion
CVE-2026-38992 represents a significant security risk for users of Cockpit versions 2.13.5 and earlier. It is crucial to update to version 2.14.0 or later to mitigate this vulnerability. Additionally, users should consider using Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for cockpit-hq/cockpit →
FAQ
The impact includes the potential for unauthorized users to execute arbitrary commands on the server, leading to data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Cockpit versions 2.13.5 and earlier are affected by this vulnerability.
If immediate updating is not possible, consider implementing network security measures to restrict access to the vulnerable endpoints.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-hq/cockpit.
