CVE-2026-109379
Last modified
CVE-2026-109379 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| cockpit-hq | cockpit | >= 2.14.1, <= 2.14.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-109379?
How severe is CVE-2026-109379?
How do I fix CVE-2026-109379?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-109373ZITADEL 3.0.0 before 4.19.2 contains an authentication bypas…8.1
- CVE-2026-109374ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation …5.5
- CVE-2026-109375Vercel deepsec from 0.1.0 before 1.1.17 contains a link foll…6.1
- CVE-2026-109376ERPNext 15.55.0 through 16.50.0 contains an incorrect author…4.3
- CVE-2026-109377ERPNext 9.0.0 through 16.50.0 contains a missing authorizati…4.3
- CVE-2026-109378SPIP before 4.4.18 contains a server-side request forgery vu…4.3
- CVE-2026-10938Inappropriate implementation in Input in Google Chrome prior…6.5
- CVE-2026-109380modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion …7.5
- CVE-2026-10939Use after free in WebRTC in Google Chrome prior to 149.0.782…8.8
- CVE-2026-109390AnyDesk before 8.0.3 allows unauthenticated remote attackers…9.8
- CVE-2026-109391Square Squash through commit e73f280 contains an insecure de…8.1
- CVE-2026-109392Pimcore through 2026.3.1 contains a stored cross-site script…5.4
Are you affected by CVE-2026-109379?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST