CVE Feed

    Dashboard / CVE / CVE-2026-109379

    CVE-2026-109379

    Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.

    Published:Oct 12, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00348
    CVSS Score:5.3

    Affected Products

    Vendor
    Cockpit-hq
    Product
    Cockpit

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-208 Observable Timing Discrepancy

    Related CVEs

    CVE-2026-105217 (CVSS 2.3) — Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart requ…
    CVE-2026-82449 (CVSS 6.9) — Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timi…
    CVE-2026-73680 (CVSS 8.7) — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows …
    CVE-2026-23695 (CVSS 5.1) — Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerab…
    CVE-2026-34965 (CVSS 8.7) — Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_col…
    CVE-2026-38993 (CVSS 6.5) — Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability …
    CVE-2026-38992 (CVSS 9.8) — Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple…
    CVE-2026-38991 (CVSS 8.8) — Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed fu…
    CVE-2026-6626 (CVSS 2.1) — A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functi…
    CVE-2026-31891 (CVSS 7.7) — Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier wi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High