CVE-2026-31891

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31891", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T21:59:02.687Z", "datePublished": "2026-03-18T02:58:12.427Z", "dateUpdated": "2026-03-18T18:36:30.952Z"}, "containers": {"cna": {"title": "Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628"}, {"name": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5"}], "affected": [{"vendor": "Cockpit-HQ", "product": "Cockpit", "versions": [{"version": "< 2.13.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T02:58:12.427Z"}, "descriptions": [{"lang": "en", "value": "Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability \u2014 no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer."}], "source": {"advisory": "GHSA-7x5c-vfhj-9628", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T18:33:48.652191Z", "id": "CVE-2026-31891", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T18:36:30.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T18:33:48.652191Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T18:34:46.299Z"}}], "cna": {"title": "Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()", "source": {"advisory": "GHSA-7x5c-vfhj-9628", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cockpit-HQ", "product": "Cockpit", "versions": [{"status": "affected", "version": "< 2.13.5"}]}], "references": [{"url": "https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628", "name": "https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5", "name": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability \u2014 no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T02:58:12.427Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31891", "state": "PUBLISHED", "dateUpdated": "2026-03-18T18:36:30.952Z", "dateReserved": "2026-03-09T21:59:02.687Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T02:58:12.427Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Cockpit", "vendor": "Cockpit-HQ", "versions": [{"status": "affected", "version": "< 2.13.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:agentejo:cockpit:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9672A33-EC5F-4489-892D-A63C0499AE5F", "versionEndExcluding": "2.13.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability \u2014 no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer."}, {"lang": "es", "value": "Cockpit es un sistema de gesti\u00f3n de contenido sin interfaz gr\u00e1fica. Cualquier instancia de Cockpit CMS que ejecute la versi\u00f3n 2.13.4 o anterior con acceso a la API habilitado es potencialmente afectada por una vulnerabilidad de inyecci\u00f3n SQL en el Optimizador de Agregaci\u00f3n de MongoLite. Cualquier despliegue donde el endpoint `/api/content/aggregate/{model}` sea accesible p\u00fablicamente o alcanzable por usuarios no confiables puede ser vulnerable, y los atacantes en posesi\u00f3n de una clave API de solo lectura v\u00e1lida (el nivel de privilegio m\u00e1s bajo) pueden explotar esta vulnerabilidad \u2014 no se requiere acceso de administrador. Un atacante puede inyectar SQL arbitrario a trav\u00e9s de nombres de campo no saneados en consultas de agregaci\u00f3n, eludir el filtro de contenido publicado `_state=1` para acceder a contenido no publicado o restringido, y extraer datos no autorizados de la base de datos de contenido SQLite subyacente. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 2.13.5. La correcci\u00f3n aplica la misma sanitizaci\u00f3n de nombres de campo introducida en la v2.13.3 para `toJsonPath()` al m\u00e9todo `toJsonExtractRaw()` en `lib/MongoLite/Aggregation/Optimizer.php`, cerrando el vector de inyecci\u00f3n en el Optimizador de Agregaci\u00f3n."}], "id": "CVE-2026-31891", "lastModified": "2026-06-17T10:34:42.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31891", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T18:33:48.652191Z", "version": "2.0.3"}}]}, "published": "2026-03-18T04:17:19.570", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/Cockpit-HQ/Cockpit/security/advisories/GHSA-7x5c-vfhj-9628"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.13.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Cockpit", "source": "cna", "vendor": "Cockpit-HQ"}, "product": "cockpit", "vendor": "cockpit-hq"}], "analysis": {"en": {"generated_at": "2026-03-20T19:25:15.315886+00:00", "value": {"mitigation_remediation": ["Upgrade Cockpit CMS to version 2.13.5 or newer.", "If an upgrade cannot be performed immediately, restrict or disable API access for untrusted users.", "Verify that the /api/content/aggregate endpoint is not publicly exposed, or limit its availability to trusted IP ranges."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Data Access"}, "threat_synthesis": {"affected_systems": "This vulnerability affects the Cockpit content management system by Cockpit-HQ. Any deployment running version 2.13.4 or older, with API access enabled and the /api/content/aggregate/{model} endpoint reachable by untrusted users, is susceptible. Core products using the affected stack include Cockpit 2.13.4 and earlier. No other vendors or products are listed.", "description_and_impact": "Cockpit CMS exposes an SQL Injection flaw in its MongoLite Aggregation Optimizer. Unsanitized field names in aggregation queries allow attackers to inject arbitrary SQL via the toJsonExtractRaw() method. This injection can breach the published-content filter, letting even a read\u2011only API key read unpublished or restricted content from the underlying SQLite database. The result is unauthorized data exposure, potentially giving attackers sensitive information without requiring administrative privileges.", "risk_and_exploitability": "The CVSS vector scores 7.7 for high severity, while the EPSS is below 1%, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the API endpoint and a valid read\u2011only API key but no admin rights. Attackers could send crafted aggregation payloads to trigger the SQL injection, read data from the SQLite store, and bypass content restrictions. A patch addressing the sanitization of toJsonExtractRaw() is available in version 2.13.5."}}}}, "created": "2026-03-18T10:41:58.549223+00:00", "updated": "2026-03-24T10:59:28.014222+00:00", "vendors": ["cockpit-hq", "cockpit-hq$PRODUCT$cockpit"]}