Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection
Priority MEDIUM 57CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed cockpit-hq/cockpit (Packagist): 2.14.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cockpit-hq | Cockpit | 2.13.0; 2.13.1; 2.13.2; 2.13.3; 2.13.4; 2.13.5 | — | No fix listed | CNA |
| — | cockpit-hq/cockpit (Packagist) | before 2.14.0 | 2.14.0 | Patch available | GHSA-5pv2-86qj-5jf9 |
- Cockpit Vendorcockpit-hq Affected 2.13.0; 2.13.1; 2.13.2; 2.13.3; 2.13.4; 2.13.5 Fixed in — No fix listed CNA
- cockpit-hq/cockpit (Packagist) Vendor— Affected before 2.14.0 Fixed in 2.14.0 Patch available GHSA-5pv2-86qj-5jf9
Remediation
- Fix · GHSA-5pv2-86qj-5jf9 cockpit-hq/cockpit (Packagist) Fixed in 2.14.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6626
- 2026-10-03 Alias added: GHSA-5pv2-86qj-5jf9
References
More cockpit-hq vulnerabilities
- TI-2020-18291 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. CVSS 3.1CRITICAL 9.8
- TI-2020-18290 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. CVSS 3.1CRITICAL 9.8
- TI-2022-02511 Insufficient Session Expiration in cockpit-hq/cockpit CVSS 3.1CRITICAL 9.8
- TI-2020-18292 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. CVSS 3.1CRITICAL 9.8
- TI-2026-42071 Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php CVSS 4.0HIGH 8.2
- TI-2026-41660 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API CVSS 4.0HIGH 8.7
Sources
- CVE-2026-6626 · CVE Program
- CVE-2026-6626 · NVD
- FIRST EPSS
- GHSA-5pv2-86qj-5jf9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences