Cockpit Arbitrary Code Execution via MongoLite Filter Parameter

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Cockpit v2.13.5 and earlier contains a critical arbitrary code execution vulnerability (CVSS 9.8) in its filter parameter handling across multiple endpoints. Attackers can exploit the MongoLite $func operator to execute arbitrary system commands directly on the underlying infrastructure, achieving complete compromise of affected systems. This vulnerability impacts any organization running vulnerable Cockpit versions, particularly those using it for infrastructure management, containerization, or system administration—making it a high-priority threat for cloud-native and on-premises deployments.

Casky's 301 matching skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability by correlating initial access techniques (TA0001) with code execution and command-line interface activity (TA0043). Practitioners using Casky would identify suspicious filter parameter inputs containing MongoLite operators, detect unexpected system command execution spawned from Cockpit processes, and recognize the lateral movement patterns typical of post-exploitation activity. The platform's MITRE ATT&CK mapping enables security teams to see how a single malicious request chains through reconnaissance, execution, and persistence—transforming raw logs into actionable intelligence that surfaces both the injection point and downstream attacker behaviors before systems are fully compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-38992.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-38992

Casky has 301 skills that investigate the attack patterns behind CVE-2026-38992. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn