critical
CVE-2026-4631
cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by Red Hat, AlmaLinux, Oracle, Rocky Linux.
Description
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | cockpit-bridge, cockpit-doc, cockpit-packagekit and 2 more | 344-3.el10_1 |
| alma 9 | cockpit, cockpit-bridge, cockpit-doc and 5 more | 344-2.el9_7 |
| Oracle Linux 9 | cockpit, cockpit-bridge, cockpit-doc and 5 more | 344-2.0.1.el9_7 |
| rocky 10 | cockpit, cockpit-bridge, cockpit-doc and 3 more | 344-3.el10_1.rocky.0.1 |
| rocky 9 | cockpit, cockpit-bridge, cockpit-doc and 3 more | 344-2.el9_7.rocky.0.1 |
| debian 13 | cockpit | 337-1+deb13u1 |
| debian 14 | cockpit | 360-1 |
| rapidfort debian 12 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort debian 13 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort fedora 43 | cockpit, cockpit-bridge, cockpit-doc and 9 more | 360-1.fc43 |
| rapidfort Oracle Linux 10 | cockpit, cockpit-bridge, cockpit-doc and 5 more | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 9 | cockpit, cockpit-bridge, cockpit-doc and 5 more | 0:344-2.0.1.el9_7 |
Show all 65 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | cockpit-bridge | 344-3.el10_1 |
| alma 10 | cockpit-doc | 344-3.el10_1 |
| alma 10 | cockpit-packagekit | 344-3.el10_1 |
| alma 10 | cockpit-storaged | 344-3.el10_1 |
| alma 10 | cockpit-system | 344-3.el10_1 |
| alma 9 | cockpit | 344-2.el9_7 |
| alma 9 | cockpit-bridge | 344-2.el9_7 |
| alma 9 | cockpit-doc | 344-2.el9_7 |
| alma 9 | cockpit-packagekit | 344-2.el9_7 |
| alma 9 | cockpit-storaged | 344-2.el9_7 |
| alma 9 | cockpit-system | 344-2.el9_7 |
| alma 9 | cockpit-ws | 344-2.el9_7 |
| alma 9 | cockpit-ws-selinux | 344-2.el9_7 |
| Oracle Linux 9 | cockpit | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-bridge | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-doc | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-packagekit | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-storaged | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-system | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-ws | 344-2.0.1.el9_7 |
| Oracle Linux 9 | cockpit-ws-selinux | 344-2.0.1.el9_7 |
| rocky 10 | cockpit | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-bridge | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-doc | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-system | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-ws | 344-3.el10_1.rocky.0.1 |
| rocky 10 | cockpit-ws-selinux | 344-3.el10_1.rocky.0.1 |
| rocky 9 | cockpit | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-bridge | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-doc | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-system | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-ws | 344-2.el9_7.rocky.0.1 |
| rocky 9 | cockpit-ws-selinux | 344-2.el9_7.rocky.0.1 |
| debian 13 | cockpit | 337-1+deb13u1 |
| debian 14 | cockpit | 360-1 |
| rapidfort debian 12 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort debian 13 | cockpit | 0:337-1+deb13u1, 0:360-1 |
| rapidfort fedora 43 | cockpit | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-bridge | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-doc | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-kdump | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-networkmanager | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-packagekit | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-selinux | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-sosreport | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-storaged | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-system | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-ws | 360-1.fc43 |
| rapidfort fedora 43 | cockpit-ws-selinux | 360-1.fc43 |
| rapidfort Oracle Linux 10 | cockpit | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-bridge | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-doc | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-packagekit | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-storaged | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-system | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-ws | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 10 | cockpit-ws-selinux | 0:344-3.0.1.el10_1 |
| rapidfort Oracle Linux 9 | cockpit | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-bridge | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-doc | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-packagekit | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-storaged | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-system | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-ws | 0:344-2.0.1.el9_7 |
| rapidfort Oracle Linux 9 | cockpit-ws-selinux | 0:344-2.0.1.el9_7 |
References
- http://www.openwall.com/lists/oss-security/2026/04/10/5
- https://access.redhat.com/errata/RHBA-2026:21387
- https://access.redhat.com/errata/RHBA-2026:21388
- https://access.redhat.com/errata/RHSA-2026:7381
- https://access.redhat.com/errata/RHSA-2026:7382
- https://access.redhat.com/errata/RHSA-2026:7383
- https://access.redhat.com/errata/RHSA-2026:7384
- https://access.redhat.com/security/cve/CVE-2026-4631
All 19 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2450246
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4631
- https://errata.almalinux.org/9/ALSA-2026-7384.html
- https://errata.rockylinux.org/RLSA-2026:7384
- https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427
- https://linux.oracle.com/cve/CVE-2026-4631.html
- https://linux.oracle.com/errata/ELSA-2026-7384.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4631
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4631.json
- https://www.cve.org/CVERecord?id=CVE-2026-4631