CVE-2026-38992: Cockpit is vulnerable to arbitrary code execution
Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
Published Apr 29, 2026 · Updated May 6, 2026
Affected packages
cockpit-hq/cockpit
- Ecosystem
- Composer (PHP)
- Affected
- < 2.14.0
- Fixed in
- 2.14.0
- Check
composer show cockpit-hq/cockpit
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology