CVE-2026-38992 - Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints

Back Back to CVE browser

CRITICAL

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints

Published Apr 29, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.73%

Description

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26232		Advisory
https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns		exploit
https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0
https://github.com/advisories/GHSA-fm6c-rhcf-7439		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-38992