Is CVE-2026-23695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23695 being exploited in the wild.

How severe is CVE-2026-23695?

Medium severity, with a CVSS score of 5.4, published 15 May 2026.

Which products and versions are affected?

cockpit-hq/cockpit (Packagist) <= 2.14.0, ECOSYSTEM:introduced=0,last_affected=2.14.0.

Is there a fix for CVE-2026-23695?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-23695 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-23695?

Check whether you run cockpit-hq/cockpit (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23695: Cockpit CMS stored XSS in Set field type Display template

Q: Is there a fix for CVE-2026-23695?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-23695 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-23695?

Check whether you run cockpit-hq/cockpit (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23695 · Severity: medium · CVSS 5.4 · Published 2026-05-15

Cockpit CMS, a content management system used to manage and distribute digital content, is vulnerable to a security flaw in its 'Set' field type. An attacker with specific content management permissions can inject malicious scripts into display templates. When other users, such as administrators, view the list of items in that collection, the script executes in their browser, potentially allowing the attacker to steal session information or perform unauthorized actions.

Technologies: cockpit-hq/cockpit (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-23695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23695 being exploited in the wild.
How severe is CVE-2026-23695?: Medium severity, with a CVSS score of 5.4, published 15 May 2026.
Which products and versions are affected?: cockpit-hq/cockpit (Packagist) <= 2.14.0, ECOSYSTEM:introduced=0,last_affected=2.14.0.
Is there a fix for CVE-2026-23695?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-23695 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-23695?: Check whether you run cockpit-hq/cockpit (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Cockpit CMS through version 2.14.0. The root cause is located in the 'Set' field type's 'Display template' option, where template strings are processed by the $interpolate function using the 'new Function()' constructor and subsequently rendered via Vue's 'v-html' directive without proper sanitization. An attacker with 'content/:models/manage' permissions can inject arbitrary JavaScript into the template. This script is executed in the browser of any user who views the collection items list. The vulnerability was addressed in commit 72a83fc by replacing the Function-based evaluation with a sandboxed JSLite execution environment.

Affected products

Cockpit-HQ Cockpit CMS <= 2.14.0

Identifiers

CVE-2026-23695
GHSA-ch4j-vcf5-58x5

Timeline

2026-05-15: disclosed
2026-05-15: advisory: NVD publication date
2026-05-21: other: GitHub Advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.