CVE-2026-6626 Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection
Remote attackers can inject malicious code into Cockpit CMS asset handlers to execute arbitrary commands, requiring immediate mitigation due to lack of vendor response.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6626?
CVE-2026-6626 is a medium-severity code injection vulnerability in Cockpit-HQ Cockpit, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-6626?
2 open source packages ship an affected version, including cockpit-hq/cockpit.
| Package | Affected | Fixed in |
|---|---|---|
cockpit-hq/cockpit Packagist | All versions | 2.14.0 |
cockpit-hq/cockpit Packagist | All versions | 2.14.0 |
How do I fix CVE-2026-6626?
Upgrade cockpit-hq/cockpit to 2.14.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-6626 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6626 exists.
Sources
Also known as GHSA-5pv2-86qj-5jf9.