Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck
CVE-2026-105217Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
Low 3.1
In plain English
A low-severity improper certificate validation in cockpit from cockpit-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.1%top 99.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cockpit-hq | cockpit | 2.12.0 – before 2.14.1 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #318 issue-tracking
- https://github.com/Cockpit-HQ/Cockpit/commit/c611492adc17362578faa97f9c30b41e6c16e040 patch
- https://github.com/Cockpit-HQ/Cockpit/blob/2.14.0/cron.php#L70-L102 technical-description
- https://github.com/Cockpit-HQ/Cockpit product
- VulnCheck Advisory: Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php third-party-advisory