EUVD-2026-23822
GHSA-5pv2-86qj-5jf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
NoSQL injection in Cockpit-HQ Cockpit up to version 2.13.5 allows authenticated remote attackers to manipulate data query logic through the Asset Handler or Aggregate Handler components, resulting in information disclosure with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Technical ContextAI
Cockpit-HQ Cockpit is a Node.js-based headless CMS and admin interface framework. The vulnerability exists in the Asset Handler and Aggregate Handler components, which process database queries. CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) indicates that user-supplied input is not properly sanitized before being incorporated into NoSQL database queries. The affected CPE string cpe:2.3:a:cockpit-hq:cockpit:*:*:*:*:*:*:*:* suggests all versions up to 2.13.5 are impacted. The attack leverages the queryable nature of NoSQL databases (likely MongoDB given Cockpit's architecture) where malicious operators and field references can be injected to bypass intended query restrictions or extract unauthorized data.
RemediationAI
Upgrade Cockpit-HQ Cockpit to version 2.13.6 or later if available; verify patch status on the official GitHub repository (github.com/reusedev/cockpit) or contact the vendor directly. Until patches are deployed, implement these compensating controls: restrict access to Cockpit admin interfaces to trusted networks only using firewall rules or reverse proxy authentication; enforce strong, unique passwords for all Cockpit user accounts and enable multi-factor authentication if supported; disable or restrict the Asset Handler and Aggregate Handler features if not actively used by regularly auditing which components are enabled in the configuration; implement database-level query monitoring to detect suspicious NoSQL injection patterns (operators like $ne, $regex, $where in unexpected contexts); and run Cockpit with minimal database privileges, using a dedicated database user account with read-only access to non-sensitive collections where possible. Each mitigation has trade-offs: network restriction may limit legitimate remote administration; feature disabling impacts functionality; database privilege reduction requires thorough testing of legitimate operations.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. Rated critical
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. Rated critical severit
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0. Rated critical severity (CVSS 9.
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. Rated critical s
Agentejo Cockpit performs actions on files without appropriate validation and therefore allows an attacker to traverse t
SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to r
PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Rated high severity (CVSS 8.8), this v
A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Admi
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1. Rated high sever
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8. Rated high severity (CVSS 8.8), this vulnerab
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.
Authenticated remote code execution in Cockpit CMS lets attackers holding collection-management privileges inject arbitr
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today