Cockpit is vulnerable to arbitrary code execution

CRITICAL 9.8CVE-2026-38992 · GHSA-fm6c-rhcf-7439 · Published 29/04/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
cockpit-hq/cockpit Packagist	`< 2.14.0`	`2.14.0`

Description

Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

NVD description

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

References

nvd.nist.gov/vuln/detail/CVE-2026-38992 · ADVISORY
felsec.com/posts/cockpit-cms-2.13.5-multi-vulns · WEB
Cockpit-HQ/Cockpit · PACKAGE
Cockpit-HQ/Cockpit release 2.14.0 · WEB
felsec.com/posts/cockpit-cms-2.13.5-multi-vulns

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free