CVE-2026-109379

Executive Summary

Cockpit CMS 2.14.1 exposes an observable timing discrepancy in the /auth/check endpoint that permits unauthenticated attackers to enumerate valid user accounts, including usernames and email addresses. The flaw arises from an incomplete timing fix: authentication attempts against existing accounts perform two bcrypt operations, while attempts against non-existent accounts perform only one, producing a measurable response-time differential. Although rated only CVSS 5.3 (Low Confidentiality impact), reliable account enumeration is a high-value reconnaissance primitive that materially lowers the cost of follow-on credential attacks against content management infrastructure.

Technical Analysis

The vulnerability is classified as CWE-208: Observable Timing Discrepancy. It affects Cockpit CMS version 2.14.1, specifically the authentication verification path reachable at the /auth/check endpoint. According to the NVD description, the root cause is an incomplete timing fix — a prior remediation attempt that normalized part of the authentication flow but left a residual branch-dependent timing difference.

The mechanism is straightforward and well-understood in the password-hashing domain. bcrypt is deliberately computationally expensive (adaptive cost factor) to resist offline cracking. When an authentication request is processed:

• If the supplied account identifier corresponds to an existing account, the application retrieves the stored bcrypt hash and executes a bcrypt comparison (one bcrypt operation). The description states existing accounts incur two bcrypt operations — consistent with a pattern where a dummy/mitigation hash is verified in addition to the real hash for valid users, or where a per-user work factor/policy check triggers a second KDF invocation.
• If the account does not exist, the application performs only one bcrypt operation — typically a fixed dummy-hash comparison intended to equalize timing (a common defensive technique to prevent user enumeration).

The incomplete fix therefore creates an asymmetry: the "user exists" branch does strictly more work than the "user does not exist" branch. Because bcrypt is intentionally slow (tens to hundreds of milliseconds depending on cost factor), this differential is observable over the network despite jitter, and is statistically separable with repeated sampling. CWE-208 is subtle precisely because the leak is not in the response body or status code but in wall-clock processing time.

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE. EPSS has not yet scored the vulnerability, so no exploitation-likelihood estimate should be assumed. The attack surface is the unauthenticated, internet-reachable /auth/check endpoint of Cockpit CMS — a headless CMS frequently exposed on content delivery and marketing subdomains.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (observable timing discrepancy) and the endpoint and behavior described in the NVD entry. No specific request parameters beyond those implied by the description are asserted.

1. Reconnaissance / Target Identification. The attacker identifies internet-facing Cockpit CMS 2.14.1 instances (e.g., via Shodan dorks such as http.html:"Cockpit" or http.html:"/auth/check"). No authentication, user interaction, or privileges are required (CVSS PR:N/UI:N).

2. Triggering the Flaw. The attacker sends authentication attempts to the /auth/check endpoint, each supplying a candidate account identifier and a password. The endpoint processes each attempt and returns a response. Crucially, the attacker does not rely on the response content — only on the elapsed server response time.

3. Execution / Measurement at the Vulnerability-Class Level. For each candidate identifier, the attacker issues a sufficient number of requests to reduce statistical noise, records the response latency distribution, and compares it against a control set of known-invalid identifiers. Requests targeting existing accounts cluster at a higher latency (two bcrypt operations); requests targeting non-existent accounts complete faster (one bcrypt operation). Candidates whose latency distribution matches the "existing" profile are classified as valid accounts. This is a classic statistical timing side-channel; no injected payload is required, and the "payload" is effectively the timing measurement itself.

4. Post-Exploitation Impact. The result is a validated list of usernames and/or email addresses. This information alone does not grant access (Confidentiality impact only, C:N/I:N/A:N sub-scores except C:L). However, it directly enables targeted credential stuffing, password spraying, phishing, and social engineering against a small, confirmed set of real accounts — and it leaks personally identifiable information (email addresses) that may carry privacy/regulatory consequences.

Impact Assessment

Per the supplied CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, the base score is 5.3 (Medium):

• Attack Vector: Network — exploitation is remote; the endpoint is typically internet-exposed.
• Attack Complexity: Low — no special conditions; only timing sampling is required.
• Privileges Required: None — entirely unauthenticated.
• User Interaction: None — no victim action needed.
• Scope: Unchanged — impact confined to the vulnerable component.
• Confidentiality: Low — leaks account existence / identifiers, not credentials or data contents.
• Integrity: None / Availability: None — no write or DoS impact.

Business impact. The direct impact is information disclosure (account enumeration). Its strategic value is as a precursor: enumerated, confirmed-valid accounts sharply reduce the search space for credential attacks, and leaked email addresses feed phishing and BEC campaigns. For organizations running Cockpit CMS as a headless content platform, exposure is amplified because the CMS often sits behind marketing sites and holds editorial credentials that pivot to content integrity and, in some deployments, broader infrastructure.

Blast radius. Any internet-reachable Cockpit CMS 2.14.1 instance is in scope. The flaw is deterministic per-account and repeatable, so an attacker can enumerate the entire user base over time. There is no KEV listing and no evidence of in-the-wild exploitation as of this report, which lowers immediate urgency but not the value of remediation.

Detection Guidance

Sigma Rule

title: Cockpit CMS Account Enumeration via /auth/check Timing Discrepancy
id: 8b2f1c4a-3d6e-4f70-9a1b-cockpit-timing-enum
status: experimental
description: Detects repeated unauthenticated POST requests to the Cockpit CMS /auth/check endpoint consistent with timing-based account enumeration (CVE-2026-109379).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109379
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/auth/check'
    cs-method: 'POST'
  selection_unauth:
    sc-status: 200
  timeframe: 5m
  condition: selection_endpoint | count() by src_ip > 25
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
  - time-taken
falsepositives:
  - Legitimate login retries by users with mistyped credentials
  - Health checks or monitoring probes against the auth endpoint
level: medium
tags:
  - attack.t1589.002
  - cve.2026.109379

YARA Rule

rule CVE_2026_109379_Cockpit_Timing_Enum_Logs
{
    meta:
        description = "Detects web/access logs indicating timing-based account enumeration against Cockpit CMS /auth/check (CVE-2026-109379)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109379"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $endpoint = "/auth/check" ascii nocase
        $post     = "POST" ascii
        $cockpit  = "cockpit" ascii nocase

    condition:
        $endpoint and $post and $cockpit
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109379 Cockpit CMS Account Enumeration via /auth/check Timing Discrepancy"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/auth/check"; nocase; threshold: type both, track by_src, count 25, seconds 300; classtype:attempted-recon; reference:cve,2026-109379; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109379; sid:2026109379; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and endsWith(http.request.uri.path, "/auth/check")]
  [http where http.request.method == "POST" and endsWith(http.request.uri.path, "/auth/check")]
  [http where http.request.method == "POST" and endsWith(http.request.uri.path, "/auth/check")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri_path, "(?i)/auth/check$") AND method="POST"
| stats count AS attempts, dc(uri_path) AS endpoints, values(status) AS status_codes BY src_ip
| where attempts > 25
| sort - attempts

Optional latency-oriented refinement, if response time is captured:

index=web sourcetype=access_combined uri_path="/auth/check" method="POST"
| stats count AS attempts, avg(response_time_ms) AS avg_resp, stdev(response_time_ms) AS sd_resp BY src_ip
| where attempts > 25 AND sd_resp > 0
| table src_ip attempts avg_resp sd_resp

Wazuh OSSEC Rule

<group name="web,cockpit,cve-2026-109379,">
  <rule id="109379" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST /auth/check</match>
    <description>CVE-2026-109379: Repeated POST to Cockpit CMS /auth/check from same source (possible account enumeration)</description>
    <mitre>
      <id>T1589.002</id>
    </mitre>
    <group>attempted_recon,</group>
  </rule>
</group>

Note: the above triggers per matching log line; pair it with a frequency/timeframe rule to suppress single login attempts and elevate only high-volume sources.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (no patch available):

• Constrain or block public access to /auth/check. Restrict it to trusted networks, VPN, or an authenticated reverse-proxy layer where feasible for the deployment model.
• Apply reverse-proxy rate limiting and per-source throttling on authentication endpoints to frustrate high-volume timing sampling.
• Where the application flow permits, enforce a fixed delay/normalization at the edge so that response timing no longer distinguishes account existence.
• Monitor for the enumeration pattern described in the Detection Guidance above; alert on high-volume or statistically anomalous /auth/check traffic per source IP.
• Reduce credential-attack value independently: enforce strong password policy and multi-factor authentication on CMS accounts, and rotate any credentials whose identifiers may have been enumerated.

2) Patch / upgrade steps:

• No vendor patch is available as of this report. Track the Cockpit CMS upstream project and monitor the NVD entry (CVE-2026-109379) and vendor release channels for a fixed version.
• When a fix is published, upgrade to the patched release and verify that the authentication path equalizes the number of bcrypt operations for existing and non-existent accounts.
• Because no affected-version range or OSV package data is currently available, validate installed version explicitly (2.14.1 is confirmed vulnerable).

3) Long-term hardening:

• Adopt a constant-work authentication design: always perform an identical number of KDF operations regardless of account existence, and return uniform responses/response times.
• Integrate timing-safety review into secure code standards, since CWE-208 fixes are frequently incomplete — test for residual discrepancies after any change (regression testing of timing behavior).
• Inventory and reduce internet-exposed CMS attack surface; place authentication endpoints behind gateways that can throttle and monitor them.
• Include account-enumeration channels in threat modeling: log, alert, and periodically validate controls against both content-based and timing-based enumeration.

References

• NVD — CVE-2026-109379: https://nvd.nist.gov/vuln/detail/CVE-2026-109379
• MITRE CWE-208 — Observable Timing Discrepancy: https://cwe.mitre.org/data/definitions/208.html
• MITRE ATT&CK T1589.002 — Gather Victim Identity Information: Email Addresses: https://attack.mitre.org/techniques/T1589/002/
• Cockpit CMS project (upstream release/advisory channel): https://github.com/Cockpit-HQ/Cockpit
• CISA Known Exploited Vulnerabilities Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild status: No known exploitation campaigns, public PoC, or KEV listing associated with CVE-2026-109379 at the time of this report. EPSS has not yet assigned a score, so exploitation likelihood cannot be quantified; detection and monitoring controls above should be deployed proactively.