CVE-2026-38992: Cockpit CMS RCE Vulnerability

CVE-2026-38992 Overview

CVE-2026-38992 is an arbitrary code execution vulnerability affecting Cockpit CMS version 2.13.5 and earlier. The vulnerability exists within multiple API endpoints that fail to properly sanitize the filter parameter, allowing attackers to leverage the MongoLite $func operator to execute arbitrary system commands on the underlying server infrastructure.

Critical Impact

Successful exploitation enables remote attackers to execute arbitrary system commands, potentially leading to complete server compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Cockpit CMS version 2.13.5 and earlier
• All installations using MongoLite as the database backend
• Environments with exposed Cockpit API endpoints

Discovery Timeline

• 2026-04-29 - CVE CVE-2026-38992 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-38992

Vulnerability Analysis

This vulnerability is a command injection flaw that arises from improper input validation in Cockpit CMS's handling of the filter parameter across multiple API endpoints. The root cause lies in the MongoLite database abstraction layer, which supports a $func operator that can be abused to invoke arbitrary PHP functions with attacker-controlled arguments.

When processing filter queries, the application does not adequately restrict the operators that can be used within the filter parameter. An attacker can craft a malicious request containing the $func operator, which instructs MongoLite to execute a specified PHP function. By targeting functions capable of system command execution (such as system(), exec(), or passthru()), an attacker can run arbitrary commands on the underlying operating system with the privileges of the web server process.

The vulnerability is particularly dangerous because it can be exploited without authentication in certain configurations, and the filter parameter is commonly exposed through public-facing API endpoints used for content retrieval.

Root Cause

The vulnerability stems from insufficient input validation and sanitization of user-supplied filter parameters. The MongoLite $func operator provides a mechanism to call arbitrary PHP functions, which was not intended to be accessible through user input. The application fails to implement an allowlist of permitted operators or properly escape dangerous function calls before processing filter queries.

Attack Vector

An attacker can exploit this vulnerability by sending crafted HTTP requests to vulnerable API endpoints with a malicious filter parameter containing the $func operator. The attack flow involves:

1. Identifying an exposed Cockpit CMS API endpoint that accepts filter parameters
2. Crafting a JSON payload that includes the $func operator targeting a command execution function
3. Passing the attacker's desired system command as the function argument
4. The MongoLite layer processes the filter and executes the specified function with the provided arguments
5. Command output may be returned in the API response or executed blindly

The vulnerability can be exploited remotely over the network without requiring any authentication in default configurations where API endpoints are publicly accessible. For detailed technical analysis, refer to the Felsec Multi-Vulnerability Analysis.

Detection Methods for CVE-2026-38992

Indicators of Compromise

• Unusual HTTP requests to Cockpit API endpoints containing $func in the request body or parameters
• Web server logs showing requests with encoded or obfuscated filter parameters targeting content endpoints
• Evidence of command execution artifacts such as new user accounts, scheduled tasks, or dropped files on the server
• Outbound network connections from the web server to unexpected external hosts

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing $func operator patterns in JSON payloads
• Deploy intrusion detection signatures for common command injection patterns within Cockpit CMS API traffic
• Monitor server process trees for child processes spawned by the web server that execute shell commands
• Analyze HTTP traffic for anomalous filter parameter values, particularly those containing function names or command strings

Monitoring Recommendations

• Enable detailed logging for all Cockpit CMS API endpoints and regularly review for suspicious filter parameter usage
• Configure file integrity monitoring on critical system directories to detect unauthorized modifications
• Set up alerting for any process execution chains originating from the PHP/web server process
• Monitor network egress for unexpected connections that could indicate data exfiltration or reverse shell activity

How to Mitigate CVE-2026-38992

Immediate Actions Required

• Upgrade Cockpit CMS to version 2.14.0 or later immediately, as this version addresses the vulnerability
• If immediate upgrade is not possible, restrict access to Cockpit API endpoints using network-level controls
• Implement WAF rules to block requests containing the $func operator in filter parameters
• Review web server and application logs for evidence of prior exploitation attempts

Patch Information

The vendor has released version 2.14.0 which addresses this vulnerability. Organizations should update their Cockpit CMS installations to this version or later. The patched release is available from the GitHub Cockpit Version Release page.

Workarounds

• Implement strict input validation at the web server or reverse proxy level to reject requests containing $func patterns
• Deploy a web application firewall with rules specifically targeting MongoLite operator abuse patterns
• Restrict network access to Cockpit CMS API endpoints to trusted IP ranges only
• Consider running Cockpit CMS in a containerized environment with restricted system call capabilities to limit the impact of successful exploitation

# Example nginx configuration to block $func operator in requests
location /api/ {
    if ($request_body ~* "\$func") {
        return 403;
    }
    proxy_pass http://cockpit_backend;
}