crítica
CVE-2026-4631
cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según Red Hat, AlmaLinux, Oracle, Rocky Linux.
Descripción
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | cockpit-bridge, cockpit-doc, cockpit-packagekit y 2 más | 344-3.el10_1 |
| alma 9 | cockpit, cockpit-bridge, cockpit-doc y 5 más | 344-2.el9_7 |
| Oracle Linux 9 | cockpit, cockpit-bridge, cockpit-doc y 5 más | 344-2.0.1.el9_7 |
| rocky 10 | cockpit, cockpit-bridge, cockpit-doc y 3 más | 344-3.el10_1.rocky.0.1 |
| rocky 9 | cockpit, cockpit-bridge, cockpit-doc y 3 más | 344-2.el9_7.rocky.0.1 |
| debian 13 | cockpit | 337-1+deb13u1 |
| debian 14 | cockpit | 360-1 |
| rapidfort debian 12 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort debian 13 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort fedora 43 | cockpit, cockpit-bridge, cockpit-doc y 9 más | 360-1.fc43 |
| rapidfort Oracle Linux 10 | cockpit, cockpit-bridge, cockpit-doc y 5 más | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 9 | cockpit, cockpit-bridge, cockpit-doc y 5 más | 0:344-2.0.1.el9_7 |
Mostrar las 65 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | cockpit-bridge | 344-3.el10_1 |
| alma 10 | cockpit-doc | 344-3.el10_1 |
| alma 10 | cockpit-packagekit | 344-3.el10_1 |
| alma 10 | cockpit-storaged | 344-3.el10_1 |
| alma 10 | cockpit-system | 344-3.el10_1 |
| alma 9 | cockpit | 344-2.el9_7 |
| alma 9 | cockpit-bridge | 344-2.el9_7 |
| alma 9 | cockpit-doc | 344-2.el9_7 |
| alma 9 | cockpit-packagekit | 344-2.el9_7 |
| alma 9 | cockpit-storaged | 344-2.el9_7 |
| alma 9 | cockpit-system | 344-2.el9_7 |
| alma 9 | cockpit-ws | 344-2.el9_7 |
| alma 9 | cockpit-ws-selinux | 344-2.el9_7 |
| Oracle Linux 9 | cockpit | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-bridge | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-doc | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-packagekit | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-storaged | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-system | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-ws | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-ws-selinux | 344-2.0.1.el9_7 |
| rocky 10 | cockpit | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-bridge | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-doc | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-system | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-ws | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-ws-selinux | 344-3.el10_1.rocky.0.1 |
| rocky 9 | cockpit | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-bridge | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-doc | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-system | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-ws | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-ws-selinux | 344-2.el9_7.rocky.0.1 |
| debian 13 | cockpit | 337-1+deb13u1 |
| debian 14 | cockpit | 360-1 |
| rapidfort debian 12 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort debian 13 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort fedora 43 | cockpit | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-bridge | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-doc | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-kdump | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-networkmanager | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-packagekit | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-selinux | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-sosreport | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-storaged | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-system | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-ws | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-ws-selinux | 360-1.fc43 |
| rapidfort Oracle Linux 10 | cockpit | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-bridge | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-doc | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-packagekit | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-storaged | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-system | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-ws | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-ws-selinux | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 9 | cockpit | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-bridge | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-doc | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-packagekit | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-storaged | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-system | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-ws | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-ws-selinux | 0:344-2.0.1.el9_7 |
Referencias
- http://www.openwall.com/lists/oss-security/2026/04/10/5
- https://access.redhat.com/errata/RHBA-2026:21387
- https://access.redhat.com/errata/RHBA-2026:21388
- https://access.redhat.com/errata/RHSA-2026:7381
- https://access.redhat.com/errata/RHSA-2026:7382
- https://access.redhat.com/errata/RHSA-2026:7383
- https://access.redhat.com/errata/RHSA-2026:7384
- https://access.redhat.com/security/cve/CVE-2026-4631
Las 19 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=2450246
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4631
- https://errata.almalinux.org/9/ALSA-2026-7384.html
- https://errata.rockylinux.org/RLSA-2026:7384
- https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427
- https://linux.oracle.com/cve/CVE-2026-4631.html
- https://linux.oracle.com/errata/ELSA-2026-7384.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4631
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4631.json
- https://www.cve.org/CVERecord?id=CVE-2026-4631