Executive brief
Cockpit is a web-based interface used to manage and monitor Linux servers. A security flaw in its system logs component allows an attacker to execute malicious commands on the server if a logged-in administrator clicks on a specially crafted link. This could lead to a full takeover of the server, unauthorized data access, or service disruption.
Technical details
An OS command injection vulnerability (CWE-78) exists in Cockpit's system logs UI, specifically within the 'loadServiceFilters()' path in 'pkg/systemd/logsJournal.jsx'. The application constructs shell commands by joining array elements into a string with insufficient sanitization before executing them via '/bin/bash -ec'. An attacker can provide malicious input through URL parameters (such as 'since' or 'boot') containing shell metacharacters or command substitutions (e.g., '$(...)'). Exploitation requires a victim with an active Cockpit session to visit a malicious link, allowing the attacker to execute commands with the privileges of the Cockpit process. The issue is resolved in Cockpit version 362.
Affected products
- Cockpit Project Cockpit Before 362
Timeline
- 2026-03-25: other: Vulnerability reported to Red Hat Bugzilla
- 2026-05-11: disclosed: Initial CVE publication
- 2026-05-20: patched: Public disclosure of fix in Cockpit 362 and technical details on oss-security