Cockpit (and its plugins) do not seem to protect itself against clickjacking : it is possible to render a page from a cockpit server via another website, inside an <iFrame> HTML entry.
This may be used by a malicious website in clickjacking, or similar, attacks.
To prevent this behavior, a X-Frame-Options header could be added to the responses.