Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Cockpit CMS lets attackers steal worker token via cron

CVE-2026-105217 · published 14 days ago
Summary

Versions of Cockpit CMS from 2.12.0 up to 2.14.0 skip checking the security certificate when the scheduled task (cron.php) restarts a web worker. This lets a network attacker who can intercept the connection present a fake certificate and capture the worker token, which could be used to start the worker without authorization. Update Cockpit CMS to version 2.14.1 or later, or apply a patch that restores proper certificate verification.

What to do
  • Update cockpit-hq cockpit to version 2.14.1 or later.
Affected software
VendorProductAffected versions
cockpit-hq cockpit < 2.14.1
Original advisory text
Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Oct 2026
Updated9 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105217 · NVD
CVE-2026-105217 · MITRE
CVE-2026-105217 · OSV
Track software like this
Free during beta