CVE-2026-109379 cockpit-hq CVE debrief

Who should care

Defenders responsible for Cockpit CMS installations, particularly those using version 2.14.1, should assess their exposure and prioritize verification and potential remediation. This includes IT security teams, system administrators, and developers who manage or maintain Cockpit CMS installations. They should be aware of the potential for account enumeration and take steps to verify the presence of this vulnerability in their environments, assess the risk,

Why it matters

CVE-2026-109379 is a MEDIUM-rated vulnerability in Cockpit CMS 2.14.1 that allows unauthenticated account enumeration via a timing discrepancy in the /auth/check endpoint. Defenders should prioritize verifying the presence of this vulnerability in their installations and assess potential impacts.

• Account enumeration can lead to targeted attacks on valid accounts
• Enumeration of valid usernames and email addresses can facilitate phishing or brute-force attacks
• The vulnerability allows attackers to gather information about existing accounts without authentication

Technical summary

The vulnerability in Cockpit CMS 2.14.1 is due to an incomplete timing fix in the /auth/check endpoint, allowing unauthenticated attackers to enumerate accounts by measuring response times. Existing accounts incur two bcrypt operations versus one for non-existent accounts, revealing valid usernames and email addresses. This issue arises from the differential processing time between existing and non-existing accounts during the authentication check, which can be exploited to gather information about valid accounts without authentication. The vulnerability's impact can be significant as it allows attackers to discern valid usernames and email addresses, potentially leading to targeted attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Cockpit CMS installations and assess the potential impact on their systems.

Recommended defensive actions

• Verify the presence of Cockpit CMS version 2.14.1 in your environment
• Assess the potential impact of account enumeration on your system
• Review and apply any available patches or fixes for the vulnerability
• Monitor for potential exploitation attempts
• Conduct a thorough review of existing accounts and related security measures
• Implement additional monitoring for suspicious login attempts
• Consider compensating controls for exposed systems while remediation is scheduled

Evidence notes

The evidence provided includes details from the CVE Program record, NVD vulnerability detail, and source item information. However, the corpus does not establish versions beyond 2.14.1, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.