CVE-2026-31891

Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer.

• CWE-89

• https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5Product, Release Notes
• https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628Patch, Vendor Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31886Dagu is a workflow engine with a built-in Web user interface…7.6
• CVE-2026-31887Shopware is an open commerce platform. Prior to 6.7.8.1 and …7.5
• CVE-2026-31888Shopware is an open commerce platform. Prior to 6.7.8.1 and …5.3
• CVE-2026-31889Shopware is an open commerce platform. Prior to 6.6.10.15 an…8.9
• CVE-2026-3189A weakness has been identified in feiyuchuixue sz-boot-paren…3.1
• CVE-2026-31890Inspektor Gadget is a set of tools and framework for data co…5.5
• CVE-2026-31892Argo Workflows is an open source container-native workflow e…8.1
• CVE-2026-31893Tunnelblick is an open source graphic user interface for Ope…5.5
• CVE-2026-31894WeGIA is a web manager for charitable institutions. In 3.6.5…7.5
• CVE-2026-31895WeGIA is a web manager for charitable institutions. Prior to…8.8
• CVE-2026-31896WeGIA is a web manager for charitable institutions. Prior to…9.8
• CVE-2026-31897FreeRDP is a free implementation of the Remote Desktop Proto…9.1