VULNERABILITY INTELLIGENCE

CVE-2026-38992

CVSS score9.8 CRITICAL
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-04-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references