CVE-2026-57855 Cockpit HQ CVE debrief

Who should care

Administrators and users of Cockpit CMS, as well as security teams and vulnerability management teams, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing affected product deployments, applying vendor patches or updates, and implementing compensating controls. Additionally, operators and platform administrators may need to review and update their security configurations to prevent exploitation of this vulnerability.

Technical summary

The vulnerability exists in the Bucket file storage API (/system/buckets/api) of Cockpit CMS. The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. This allows any authenticated user, regardless of role, to perform all bucket operations on any named bucket, including buckets intended for admin use only. The vulnerability can be mitigated by applying vendor patches or updates, implementing compensating controls, and restricting access to the Bucket file storage API.

Defensive priority

High

Recommended defensive actions

• Inventory and verify the presence of affected software versions
• Apply vendor patches or updates if available
• Implement compensating controls such as monitoring and exception tracking
• Restrict access to the Bucket file storage API
• Review and update security configurations to prevent exploitation
• Perform additional testing to validate the vulnerability and verify the effectiveness of mitigations
• Track exceptions and retest remediated assets to ensure that the vulnerability is fully resolved

Evidence notes

The CVE record and source references provide evidence of the vulnerability in Cockpit CMS's Bucket file storage API. However, further verification is needed to confirm the affected software versions and the presence of patches or updates. This may involve reviewing the vendor's documentation, checking for security advisories, and performing additional testing to validate the vulnerability. Additionally, defenders should verify the presence of affected product deployments in their environments and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.