CVE-2026-38992

—

CVSS 3.1

9.8 critical

EPSS

<1%p36

Published

Apr 29, 2026 (Apr 29, 2026)

Modified

Jun 17, 2026

Description

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.