Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass the `_state=1` published-content filter to access unpublished or restricted content, and extract unauthorized data from the underlying SQLite content database. This vulnerability has been patched in version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()` to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection vector in the Aggregation Optimizer.

The version of Cockpit CMS running on the remote web server is prior to 2.13.5. It is, therefore, affected by a SQL injection vulnerability in the MongoLite Aggregation Optimizer.

  - An unsanitized field name in the toJsonExtractRaw() method in lib/MongoLite/Aggregation/Optimizer.php     allows an attacker with a valid read-only API key to inject arbitrary SQL via the     /api/content/aggregate/{model} endpoint. Successful exploitation may bypass the published-content filter     and extract unauthorized data from the underlying SQLite content database. (CVE-2026-31891)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or     earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the     MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is     publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a     valid read-only API key (the lowest privilege level) can exploit this vulnerability  no admin access is     required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass     the `_state=1` published-content filter to access unpublished or restricted content, and extract     unauthorized data from the underlying SQLite content database. This vulnerability has been patched in     version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()`     to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection     vector in the Aggregation Optimizer. (CVE-2026-31891)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or
    earlier with API access enabled is potentially affected by a a SQL Injection vulnerability in the
    MongoLite Aggregation Optimizer. Any deployment where the `/api/content/aggregate/{model}` endpoint is
    publicly accessible or reachable by untrusted users may be vulnerable, and attackers in possession of a
    valid read-only API key (the lowest privilege level) can exploit this vulnerability — no admin access is
    required. An attacker can inject arbitrary SQL via unsanitized field names in aggregation queries, bypass
    the `_state=1` published-content filter to access unpublished or restricted content, and extract
    unauthorized data from the underlying SQLite content database. This vulnerability has been patched in
    version 2.13.5. The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()`
    to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`, closing the injection
    vector in the Aggregation Optimizer. (CVE-2026-31891)

ID	Name	Product	Family	Type	Severity
303195	Cockpit < 2.13.5 SQLi (GHSA-7x5c-vfhj-9628)	Nessus	CGI abuses	Remote	medium
303008	Linux Distros Unpatched Vulnerability : CVE-2026-31891	Nessus	Misc.	Local	medium
438884	SCA: security update for cockpit-hq/cockpit (GHSA-7x5c-vfhj-9628)	Tenable Cloud Security	SCA Checks	Local	medium
438884	SCA: security update for cockpit-hq/cockpit (GHSA-7x5c-vfhj-9628)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-31891

medium

Tenable Plugins

medium

medium

medium

medium