CVE-2026-105217 in Cockpit
Summary
by MITRE • 10/04/2026
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and start the web worker.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in Cockpit CMS versions prior to 2.14.1 represents a critical failure in transport layer security during internal service communication. Specifically, the cron.php script, which is responsible for restarting or managing the background web workers that handle asynchronous tasks and scheduled jobs, fails to validate the TLS certificate presented by the target server when initiating outbound requests. This configuration error effectively disables mutual authentication and integrity verification for these specific API calls, creating a significant security gap in environments where Cockpit CMS relies on HTTPS connections for its operational components. The flaw is particularly dangerous because it occurs during an internal administrative operation that requires elevated privileges to execute, yet the system blindly trusts any certificate presented by the destination host without verifying its authenticity against trusted root authorities or checking for revocation status.
From a technical perspective, this vulnerability allows for a classic man-in-the-middle attack scenario where an adversary positioned on the network path between the Cockpit CMS server and the site_url endpoint can intercept and manipulate traffic. By presenting a self-signed certificate or a certificate issued by a compromised Certificate Authority, the attacker can establish an encrypted connection that appears valid to the vulnerable cron.php worker process. Once this fraudulent TLS session is established, the attacker gains visibility into all data transmitted over this channel, including sensitive authentication tokens such as the web/token value. This token serves as a credential for authenticating subsequent requests to the Cockpit CMS API, effectively granting the attacker administrative access to the content management system without needing valid user credentials or exploiting other software bugs.
The operational impact of this vulnerability is severe, as it leads directly to unauthorized access and potential full compromise of the affected CMS instance. An attacker who successfully captures the worker token can impersonate the legitimate web worker process, allowing them to execute arbitrary API calls with administrative privileges. This capability enables a range of malicious activities including data exfiltration, modification or deletion of content, installation of backdoors, and further lateral movement within the network if other services are accessible via the same authentication mechanism. The risk is amplified in cloud environments or shared hosting scenarios where network traffic may traverse untrusted segments or be susceptible to interception by compromised infrastructure components.
This flaw aligns with CWE-295 Improper Certificate Validation, as the application does not properly verify the validity of certificates received during TLS handshakes. Furthermore, it relates to CWE-319 Cleartext Transmission of Authentication Credentials if the token is transmitted in a manner that allows interception due to the lack of mutual authentication integrity checks. In terms of offensive security frameworks, this vulnerability facilitates MITM attacks as described in ATT&CK technique T1557, which covers Adversary-in-the-Middle scenarios where attackers intercept communications between two parties who believe they are directly communicating with each other. The exploitation path also touches upon credential theft mechanisms similar to those outlined in ATT&CK tactic TA0006 Credential Access.
To mitigate this vulnerability, administrators must upgrade Cockpit CMS to version 2.14.1 or later, where the issue has been resolved by enforcing strict TLS certificate verification for all outbound requests made by the cron.php worker process. In addition to upgrading software, organizations should implement network segmentation strategies to isolate web servers from potentially untrusted networks and ensure that internal services communicate over secure, monitored channels. It is also advisable to review existing deployments of Cockpit CMS running versions between 2.12.0 and 2.14.1 for signs of compromise, such as unexpected API calls or unauthorized content changes, given the window of exposure during which tokens may have been stolen. Regular security audits and adherence to secure coding practices that mandate certificate pinning or strict validation in all TLS connections are essential preventive measures against this class of vulnerability.