Cockpit versions 2.13.5 and earlier contain a critical vulnerability (CVE-2026-38992) that allows arbitrary code execution via the filter parameter in multiple endpoints. The flaw arises from improper handling of the MongoLite $func operator, enabling attackers to execute system commands on the underlying infrastructure. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction. The issue is fixed in Cockpit version 2.14.0.