GHSA-fm6c-rhcf-7439 · Severity: critical · Ecosystem: composer — Cockpit is vulnerable to arbitrary code execution
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
Conclusion & alert: CVE-2026-38992 is rated Moderate Risk (51.4/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.43%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.08% | 0.43% | +0.35% |
| 2 | 2026-05-01 | 0.02% | 0.08% | +0.06% |
| 3 | 2026-04-30 | — | 0.02% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
GHSA-fm6c-rhcf-7439 · Severity: critical · Ecosystem: composer — Cockpit is vulnerable to arbitrary code execution
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||