CVE-2026-38992 Cockpit is vulnerable to arbitrary code execution
Attackers can execute arbitrary system commands on Cockpit CMS servers via the filter parameter, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-38992?
CVE-2026-38992 is a critical code injection vulnerability in n/a, published on 29 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
Weakness: CWE-94
Which versions are affected by CVE-2026-38992?
2 open source packages ship an affected version, including cockpit-hq/cockpit.
| Package | Affected | Fixed in |
|---|---|---|
cockpit-hq/cockpit Packagist | All versions | 2.14.0 |
cockpit-hq/cockpit Packagist | All versions | 2.14.0 |
How do I fix CVE-2026-38992?
Upgrade cockpit-hq/cockpit to 2.14.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-38992 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-38992 exists.
Sources
Also known as GHSA-fm6c-rhcf-7439.