What is the CVSS score of CVE-2026-38992?

CVE-2026-38992 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cockpit CMS are affected by CVE-2026-38992?

Cockpit CMS versions 2.13.5 and earlier contain a critical remote code execution vulnerability affecting unauthenticated users, enabling complete server compromise through malicious filter…. A patch is available.

How to fix or mitigate CVE-2026-38992?

Within 24 hours: Identify all Cockpit CMS deployments and document versions in use; immediately isolate affected instances from production networks or restrict inbound access to trusted sources only. Within 7 days: Evaluate migration to alternative CMS platforms or implement Web Application Firewall (WAF) rules blocking requests containing suspicious MongoLite $func operator syntax in filter parameters across all endpoints. Within 30 days: Execute migration plan to non-vulnerable CMS or await vendor patch release; conduct forensic audit for indicators of compromise on all affected systems.

Cockpit CMS CVE-2026-38992

EUVD-2026-26232 CRITICAL

Code Injection (CWE-94)

2026-04-29 mitre

GHSA-fm6c-rhcf-7439

Code Injection RCE N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Apr 30, 2026 - 16:22 vuln.today

Analysis Generated

Apr 30, 2026 - 16:22 vuln.today

CVSS changed

Apr 30, 2026 - 16:22 NVD

9.8 (None) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 29, 2026 - 14:45 euvd

EUVD-2026-26232

Analysis Generated

Apr 29, 2026 - 14:45 vuln.today

CVE Published

Apr 29, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

AnalysisAI

Remote code execution in Cockpit CMS versions 2.13.5 and earlier allows unauthenticated attackers to execute arbitrary system commands on the server by injecting malicious payloads through the filter parameter across multiple endpoints. The vulnerability exploits the MongoLite database layer's $func operator, which processes user-controlled input as executable code. Public proof-of-concept exists and the attack is fully automatable with total system compromise potential, though EPSS scoring suggests limited observed exploitation attempts (2nd percentile) at time of analysis.

Technical ContextAI

Cockpit CMS is a headless content management system built on PHP that uses MongoLite, a MongoDB-like database abstraction layer. The vulnerability stems from CWE-94 (code injection) where the MongoLite query engine accepts callback operators like $func, $fn, $f, and $where that can execute arbitrary PHP code. The filter parameter in API endpoints passes unsanitized user input directly into MongoLite query processing. When an attacker supplies a crafted filter containing the $func operator with malicious PHP code, the database layer evaluates it as executable logic rather than data, enabling direct system command execution through PHP functions like system(), exec(), or shell_exec(). This represents a classic server-side code injection vulnerability in a database query abstraction layer, similar to NoSQL injection but with code execution capabilities rather than just data manipulation.

RemediationAI

Immediately upgrade to Cockpit CMS version 2.14.0 or later, available from the official GitHub repository at https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.14.0. The patched version restricts MongoLite query callbacks ($func, $fn, $f, $where, and direct criteria callbacks) to anonymous closures only, preventing injection of arbitrary executable code. The security release also addresses multiple other vulnerabilities including path traversal in Bucket functionality and XSS in field components. If immediate patching is not feasible, implement web application firewall rules to block requests containing the strings $func, $fn, $f, or $where in any parameter, though this approach may break legitimate functionality if the application uses these operators internally. Alternatively, restrict network access to the Cockpit CMS administrative interface to trusted IP addresses only and place the application behind authentication at the reverse proxy layer, though this significantly reduces the system's usability as a headless CMS API. Both workarounds have substantial operational trade-offs and should be considered temporary measures only until the vendor patch can be applied.