CVE-2026-105217

Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Published Oct 4, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.

Analysis

Technical impact

The vulnerability causes the web worker restart script cron.php to disable TLS certificate verification. This allows an attacker on the outbound network path to the site to impersonate the target with any certificate, intercept the token used to start the web worker, and then launch the worker with that stolen token. The result is a confidentiality compromise that could allow unauthorized initiation of the web worker, potentially enabling further exploitation. The weakness is categorized as improper authentication via certificate validation, CWE‑295.

Affected Systems

Cockpit CMS by cockpit-hq, versions 2.12.0 through 2.14.0. The issue is fixed in version 2.14.1 and later.

Risk and Exploitability

The CVSS score is 2.3, indicating a low severity impact, and the EPSS score is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need control of the network path to the site URL, making the attack vector intra‑network or man‑in‑the‑middle on outbound traffic. Given the low CVSS, the risk is primarily for systems that rely on the cron.php web worker and do not have additional protective controls such as TLS pinning or strict outbound filtering.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cockpit-hq

cockpit

unaffected

Version	Status	Constraints
`2.12.0`	affected	< 2.14.1

No data.

Vendor Product Versions

Cockpit-hq

Cockpit

Version	Status	Scheme	Platform
`[2.12.0,2.14.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Cockpit CMS to version 2.14.1 or later to restore proper TLS verification
If an upgrade is not immediately possible, modify cron.php to re‑enable certificate verification or remove the insecure call to file_get_contents or curl that bypasses validation
Restrict outbound HTTPS traffic to trusted endpoints or enforce TLS certificate validation at the network layer

Generated by OpenCVE AI on October 4, 2026 at 18:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.103% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Cockpit-HQ/Cockpit
https://github.com/Cockpit-HQ/Cockpit/blob/2.14.0/cron.php#L70-L102
https://github.com/Cockpit-HQ/Cockpit/commit/c611492adc17362578faa97f9c30b41e6c16e040
https://github.com/Cockpit-HQ/Cockpit/issues/318
https://nvd.nist.gov/vuln/detail/CVE-2026-105217
https://www.cve.org/CVERecord?id=CVE-2026-105217
https://www.vulncheck.com/advisories/cockpit-cms-2.12.0-before-2.14.1-disabled-tls-verification-via-cron-php

History

Oct 5, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 5, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-105217 https://www.cve.org/CVERecord?id=CVE-2026-105217
Metrics	threat_severity `None`	threat_severity `Low`

Oct 4, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cockpit-hq Cockpit-hq cockpit
Vendors & Products		Cockpit-hq Cockpit-hq cockpit

Oct 4, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.
Title		Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
Weaknesses		CWE-295
References		https://github.com/Cockpit-HQ/Cockpit https://github.com/Cockpit-HQ/Cockpit/blob/2.14.0/cron.php#L70-L102 https://github.com/Cockpit-HQ/Cockpit/commit/c611492adc17362578faa97f9c30b41e6c16e040 https://github.com/Cockpit-HQ/Cockpit/issues/318 https://www.vulncheck.com/advisories/cockpit-cms-2.12.0-before-2.14.1-disabled-tls-verification-via-cron-php
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`