Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-6626: Cockpit-HQ Cockpit: Unvalidated Data in Query Logic
CVE-2026-6626 · published 6 months ago
Summary
An attacker can inject malicious data into Cockpit-HQ Cockpit's Asset Handler/Aggregate Handler, potentially leading to unauthorized access or actions. This vulnerability can be exploited remotely and has already been made public. It is recommended that users update to the latest version, 2.13.6, to mitigate this risk.
What to do
- Update cockpit-hq cockpit to version 2.14.0.
- Update cockpit-hq cockpit-hq/cockpit to version 2.14.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | cockpit-hq | cockpit |
< 2.14.0 Fix: upgrade to 2.14.0
|
| Packagist | cockpit-hq | cockpit-hq/cockpit |
< 2.14.0 Fix: upgrade to 2.14.0
|
Original advisory text
Cockpit has NoSQL Injection Through Content Aggregation Pipelines
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-20Improper Input Validation
CWE-943Improper Neutralization of Special Elements in Data Query Logic
Timeline
Published20 Apr 2026
Updated4 Nov 2026
First seen22 Apr 2026
Track software like this
Free during beta