CVE-2026-105217: Cockpit CMS Information Disclosure Flaw

CVE-2026-105217 Overview

CVE-2026-105217 is a certificate validation flaw in Cockpit CMS versions 2.12.0 through 2.14.0. The cron.php web worker restart request disables Transport Layer Security (TLS) certificate verification when calling back to site_url. An attacker positioned on the outbound network path can present any certificate and intercept the request. The attacker then captures the worker/web/token value and uses it to start the web worker. This weakness is categorized as [CWE-295] Improper Certificate Validation. Cockpit CMS 2.14.1 restores proper certificate verification.

Critical Impact
A man-in-the-middle attacker on the outbound path can steal the Cockpit CMS worker token and start the web worker.

Affected Products

Cockpit CMS 2.12.0
Cockpit CMS 2.13.x
Cockpit CMS 2.14.0

Discovery Timeline

2026-10-04 - CVE-2026-105217 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105217

Vulnerability Analysis

Cockpit CMS is an open-source headless content management system written in PHP. The cron.php endpoint handles scheduled task execution and web worker lifecycle management. When executed in web mode, cron.php issues an HTTP request back to the configured site_url to start the asynchronous web worker. This outbound request includes the worker/web/token value, which authenticates the worker start operation.

The vulnerable implementation configures the HTTP client to skip TLS certificate verification. Any TLS peer along the outbound route can therefore terminate the connection and present a self-signed or attacker-controlled certificate without triggering an error. The client proceeds to send the worker token to the untrusted peer, exposing it to capture.

Once the attacker holds the token, they can invoke the web worker start endpoint directly. Impact is limited to worker invocation and token exposure, which the CVSS 4.0 vector reflects with low confidentiality impact and no integrity or availability impact on the target.

Root Cause

The root cause is explicit disablement of TLS peer verification in the HTTP client used by cron.php lines 70-102. Verification options such as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST were set to permissive values, so forged certificates were accepted without validation.

Attack Vector

The attacker must occupy an adjacent network position on the path between the Cockpit CMS server and the host that resolves site_url. This includes rogue upstream proxies, compromised routers, or hostile Wi-Fi segments. When cron.php fires the worker restart request, the attacker intercepts it, serves any certificate, and reads the worker/web/token value from the request. The attacker then replays the token to start the web worker.

php

 }
 
 $master = Cockpit::instance();
-$debug  = $master->retrieve('debug',false);
+$debug  = $master->retrieve('debug', false);
 
 // is web based cron execution?
 if (!APP_CLI) {

Source: GitHub Commit c611492. The upstream patch refactors URL construction and re-enables TLS verification in the cron.php worker restart flow. See the vulnerable code region for context.

Detection Methods for CVE-2026-105217

Indicators of Compromise

Outbound HTTPS requests from the Cockpit CMS host to site_url that terminate at an unexpected IP address or autonomous system.
TLS handshakes from the Cockpit host accepting certificates not issued by the expected certificate authority.
Unexpected invocations of the Cockpit web worker start endpoint containing a valid worker/web/token from a non-local source address.
Cockpit CMS deployments reporting a version string between 2.12.0 and 2.14.0 in /modules/App/version.

Detection Strategies

Inventory web servers for Cockpit CMS installations and compare the installed version against 2.14.1.
Inspect HTTP access logs for cron.php requests followed by anomalous worker start calls from external addresses.
Capture egress traffic from Cockpit hosts and verify that TLS peers presenting the site_url certificate chain to the expected authority.
Review the GitHub Issue #318 and VulnCheck Advisory for Cockpit CMS for upstream guidance.

Monitoring Recommendations

Alert on repeated TLS certificate changes on the hostname resolved by site_url.
Monitor for worker token values appearing in logs or traffic outside the Cockpit host.
Track process creation of PHP web worker tasks that were not initiated by the local cron.php scheduler.

How to Mitigate CVE-2026-105217

Immediate Actions Required

Upgrade all Cockpit CMS instances to version 2.14.1 or later.
Rotate any worker/web/token secrets that may have transited an untrusted network since 2.12.0 was deployed.
Restrict outbound network paths from the Cockpit host so site_url resolves over trusted infrastructure only.

Patch Information

The fix is published in the upstream GitHub Cockpit Repository through commit c611492adc17362578faa97f9c30b41e6c16e040. The commit restores TLS peer verification in the cron.php web worker restart request and refactors URL construction. Administrators should pull Cockpit CMS 2.14.1 or a later release and redeploy.

Workarounds

Run cron.php from the command line interface (APP_CLI mode) so the vulnerable web-based restart path is not exercised.
Enforce TLS inspection at an egress proxy that pins the expected site_url certificate and blocks unknown issuers.
Terminate the Cockpit site_url endpoint on 127.0.0.1 or a Unix socket to remove exposure to adjacent-network interception.

bash

# Verify installed Cockpit CMS version and upgrade
grep -R "'version'" /var/www/cockpit/modules/App/ | head
cd /var/www/cockpit && git fetch --tags && git checkout 2.14.1
php cron.php  # run via CLI to bypass the web worker restart path