SQL Injection Vulnerability in Cockpit CMS Affects Multiple Versions by Cockpit HQ
CVE-2026-31891

7.7HIGH

Key Information:

Vendor

Cockpit-hq

Status
Cockpit
Vendor
CVE Published:
18 March 2026

What is CVE-2026-31891?

Cockpit CMS, a headless content management system, has a vulnerability that allows for SQL Injection via the MongoLite Aggregation Optimizer. Instances running version 2.13.4 or earlier with API access enabled are at risk. If the '/api/content/aggregate/{model}' endpoint is accessible to untrusted users, attackers holding a read-only API key can exploit this flaw. This enables them to inject arbitrary SQL through unsanitized field names, bypass published content filters, and extract unauthorized information from the SQLite database. Users are advised to upgrade to version 2.13.5, where field-name sanitization measures have been implemented to secure the Aggregation Optimizer.

Affected Version(s)

Cockpit < 2.13.5

References

https://github.com/Cockpit-HQ/Cockpit/security/advisories...
x_refsource_CONFIRM
https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.