CVE-2026-38992: Cockpit is vulnerable to arbitrary code execution
Cockpit is vulnerable to arbitrary code execution
Other sources
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
— NVD
Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cockpit-hq/cockpitto a version that resolves this vulnerability.Fixed in 2.14.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38992?
CVE-2026-38992 is rated as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-38992?
To fix CVE-2026-38992, upgrade to Cockpit version 2.14.0 or later.
What systems are affected by CVE-2026-38992?
CVE-2026-38992 affects Cockpit version 2.13.5 and earlier.
What type of vulnerability is CVE-2026-38992?
CVE-2026-38992 is an arbitrary code execution vulnerability linked to the filter parameter in multiple Cockpit endpoints.
Can exploitation of CVE-2026-38992 allow remote attacks?
Yes, exploitation of CVE-2026-38992 can allow remote attackers to execute system commands on the underlying infrastructure.