Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing
Priority LOW 37CWE-208Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-208.
Summary
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed cockpit (cockpit-hq): 2.14.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cockpit-hq | cockpit | before 2.14.1 | 2.14.1 | Patch available | CNA |
- cockpit Vendorcockpit-hq Affected before 2.14.1 Fixed in 2.14.1 Patch available CNA
Remediation
- Fix · CNA cockpit (cockpit-hq) Fixed in 2.14.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82449
- 2026-10-03 Alias added: GHSA-x5j5-9mrv-74fr
References
More cockpit-hq vulnerabilities
- TI-2020-18291 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. CVSS 3.1CRITICAL 9.8
- TI-2020-18290 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. CVSS 3.1CRITICAL 9.8
- TI-2022-02511 Insufficient Session Expiration in cockpit-hq/cockpit CVSS 3.1CRITICAL 9.8
- TI-2020-18292 Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. CVSS 3.1CRITICAL 9.8
- TI-2026-42071 Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php CVSS 4.0HIGH 8.2
- TI-2026-41660 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API CVSS 4.0HIGH 8.7
Sources
- CVE-2026-82449 · CVE Program
- CVE-2026-82449 · NVD
- FIRST EPSS
- GHSA-x5j5-9mrv-74fr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences