CVE Feed

    Dashboard / CVE / CVE-2026-82449

    CVE-2026-82449

    Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.

    Published:Aug 29, 2026
    Last Modified:Aug 31, 2026
    EPS:Aug 29, 2026
    EPSS Score:0.00244
    CVSS Score:5.3

    Affected Products

    Vendor
    Cockpit-hq
    Product
    Cockpit

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-208 Observable Timing Discrepancy

    Related CVEs

    CVE-2026-73680 (CVSS 8.7) — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows …
    CVE-2026-23695 (CVSS 5.1) — Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerab…
    CVE-2026-34965 (CVSS 8.7) — Cockpit CMS contains an authenticated remote code execution vulnerability in the /cockpit/collections/save_col…
    CVE-2026-38991 (CVSS 8.8) — Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed fu…
    CVE-2026-38993 (CVSS 6.5) — Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability …
    CVE-2026-38992 (CVSS 9.8) — Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple…
    CVE-2026-6626 (CVSS 2.1) — A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functi…
    CVE-2026-31891 (CVSS 7.7) — Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier wi…
    CVE-2025-7053 (CVSS 5.1) — A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some u…
    CVE-2025-1025 (CVSS 7.7) — Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attac…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High