CVE-2026-105217

Published 4 October 2026 · tracked since 4 October 2026

Description

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to site_url can present any certificate to steal the worker/web/token value and

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105219 HIGH 7.5
• CVE-2026-105089 HIGH 8.7
• CVE-2026-105224 MEDIUM 5.4
• CVE-2026-105215 CRITICAL 9.1
• CVE-2026-105158 HIGH 7.3
• CVE-2026-105156 LOW 3.7
• CVE-2026-105146 MEDIUM 4.7
• CVE-2026-105144 MEDIUM 5.3
• CVE-2026-105137 MEDIUM 5
• CVE-2026-86817

→ Open the live CVE board · all tools