GitHub Advisoryadvisory · Packagist

GHSA-fm6c-rhcf-7439 Cockpit is vulnerable to arbitrary code execution

CRITICAL Published 2026-04-29 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-38992
Ecosystem
Packagist
Packages
cockpit-hq/cockpit
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2026-05-06

Affected packages

• Packagist cockpit-hq/cockpit: < 2.14.0 → fixed in 2.14.0

Description

Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Related

Alias · CVE (1)

  • CVE-2026-38992 Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References