PT-2026-25975 · Cockpit · Cockpit

Ffasterss · Published 2026-03-17 · Updated 2026-03-26 · CVE-2026-31891

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cockpit versions 2.13.4 and earlier

Description Cockpit is a headless content management system. Instances running version 2.13.4 or earlier with API access enabled are susceptible to a SQL Injection issue in the MongoLite Aggregation Optimizer. The /api/content/aggregate/{model} API endpoint, when publicly accessible or reachable by untrusted users, presents a risk. An attacker with a valid read-only API key can inject arbitrary SQL through unsanitized field names in aggregation queries. This allows bypassing the state=1 published-content filter to access unpublished or restricted content and extract unauthorized data from the underlying SQLite content database. The toJsonExtractRaw() function in lib/MongoLite/Aggregation/Optimizer.php is the source of the issue.

Recommendations Upgrade to version 2.13.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-31891

GHSA-7X5C-VFHJ-9628

Affected Products

Cockpit

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31891.json · Exploit
• https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31891 · Security Note
• https://ubuntu.com/security/CVE-2026-31891 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31891 · Security Note
• https://osv.dev/vulnerability/GHSA-7x5c-vfhj-9628 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31891 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31891 · Vendor Advisory
• https://github.com/Cockpit-HQ/Cockpit · Note
• https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5 · Note
• https://twitter.com/VulmonFeeds/status/2034286075904926061 · Twitter Post
• https://twitter.com/CVEarity/status/2034177362880041446 · Twitter Post
• https://twitter.com/CVEnew/status/2034136416163090942 · Twitter Post
• https://twitter.com/integ_sec/status/2037179477734691123 · Twitter Post
• https://twitter.com/cyberbivash/status/2034140252764266918 · Twitter Post