A security vulnerability has been detected in agentejo Cockpit CMS up to 0

CVE-2026-13533 is a direct-request / forced-browsing flaw in agentejo Cockpit CMS versions 0.12.0 through 0.12.2. The htaccess handler fails to deny access to /config/config.yaml, so an unauthenticated remote attacker can simply GET the URL and walk away with whatever the operator put in Spyc::YAMLLoad config — typically database DSN, SMTP creds, API tokens, and the application secret. There is no memory corruption, no code execution primitive in the bug itself; it is a config-disclosure issue with CWE-425 / CWE-552 as the underlying weaknesses.

The vendor-assigned MEDIUM (5.3, AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N) is honest. Confidentiality is *Low* because what leaks is bounded to the YAML file, but in practice that file is the keys to the kingdom for a small Cockpit install. The score is held down by two real factors: Cockpit's installed base is tiny, and the 0.12.x line was superseded years ago by the 2.x rewrite — anyone still running 0.12.2 in 2026 has bigger hygiene problems than this CVE.

Why this verdict

• Friction — abandoned branch: Cockpit 0.12.x predates the 2.x rewrite by years; anyone still on it is statistically rare and often air-gapped behind reverse proxies.
• Friction — no second-order primitive in the CVE itself: the bug leaks a config file, not code execution. Escalation to RCE requires chaining a *separate* unpatched bug or a misconfigured DB.
• Friction — modern deployments dereference secrets via env: even when config.yaml is read, well-run installs store only env(KEY) references, neutering the confidentiality impact.
• Role multiplier: Cockpit is a small headless CMS for content management — the realistic deployment-role spectrum is (a) marketing microsite, (b) small-org blog, (c) developer sandbox. None of these are identity, PKI, hypervisor, or supply-chain roles. The role-multiplier floor stays at MEDIUM.
• No exploit-population pressure: no KEV, no observed campaigns, no EPSS signal — a baseline MEDIUM is appropriate against an abandoned product.

Why not higher?

Not HIGH because the vendor CVSS is honest about scope: only confidentiality is touched, and only of a single config file. There is no integrity or availability impact in the bug itself, and the affected-population evidence (small Cockpit footprint, abandoned 0.12.x branch) does not support an upgrade.

Why not lower?

Not LOW because the exploit is unauthenticated, network-reachable, and a one-line curl — that is genuinely dangerous when the config.yaml does contain secrets, which it usually did in the 0.12.x era before env-indirection became common.

1. Block /config/ and *.ya?ml at the reverse proxy — Add an explicit location ~* /config/ { deny all; } (nginx) or <LocationMatch> Require all denied (Apache) in front of every Cockpit instance. This neutralizes the exploit entirely with no code change. Deploy as soon as possible — there is no noisgate mitigation SLA for MEDIUM, but this is a 30-minute change, do it this sprint.
2. Rotate every secret currently in config.yaml — Assume disclosure has already happened on any internet-facing 0.12.x instance: rotate sec-key, DB password, SMTP creds, and any API tokens listed. Move them to .env and reference via env(...) in the YAML.
3. Migrate off the 0.12.x branch — Cockpit 2.x is a separate codebase; plan a content export/import within the noisgate remediation SLA of 365 days for MEDIUM. If migration is infeasible, decommission the install.
4. Gate the admin panel behind SSO or IP allowlist — Reduces the post-disclosure pivot path (step 4 in the chain). Even if secrets leak, the attacker cannot reach /auth/login to forge a session.

Run from an auditor workstation (not the target) against each suspected Cockpit host. Requires curl only, no privileges. Invoke as: ./check_cve_2026_13533.sh https://cms.example.com

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13533
# Detects exposed /config/config.yaml on agentejo Cockpit CMS 0.12.x
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <https://host[:port][/path-to-cockpit]>" >&2
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"
UA='noisgate-verifier/1.0'
PATHS=("/config/config.yaml" "/cockpit/config/config.yaml")

found_vuln=0
found_cockpit=0

# 1. Fingerprint Cockpit presence
ROOT=$(curl -sk -A "$UA" --max-time 10 "$TARGET/" || true)
if grep -qiE 'cockpit|agentejo' <<<"$ROOT"; then
  found_cockpit=1
fi

# 2. Probe each candidate config path
for p in "${PATHS[@]}"; do
  URL="$TARGET$p"
  CODE=$(curl -sk -A "$UA" --max-time 10 -o /tmp/ng_cfg.$$ -w '%{http_code}' "$URL" || echo '000')
  if [[ "$CODE" == "200" ]] && grep -qE '^(database|sec-key|mailer|app):' /tmp/ng_cfg.$$; then
    echo "VULNERABLE: $URL returned 200 with YAML config keys"
    found_vuln=1
  fi
  rm -f /tmp/ng_cfg.$$
done

if [[ $found_vuln -eq 1 ]]; then
  echo "RESULT: VULNERABLE"
  exit 1
elif [[ $found_cockpit -eq 1 ]]; then
  echo "RESULT: PATCHED (Cockpit detected, config not exposed)"
  exit 0
else
  echo "RESULT: UNKNOWN (no Cockpit fingerprint observed)"
  exit 3
fi

Sources

1. Vulnerability-Lookup CVE-2026-13533
2. GitHub Security Advisory GHSA-q4hh-wg87-823q
3. OpenCVE — agentejo Cockpit CVE listing
4. CVEDetails — Agentejo Cockpit
5. Metasploit — Cockpit CMS NoSQLi to RCE (chained context)
6. CWE-425 — Direct Request (Forced Browsing)
7. CWE-552 — Files or Directories Accessible to External Parties
8. Cockpit project on GitHub (agentejo)