Skip to content
Fencer Vulns
critical 9.8

CVE-2026-4631 in the critical feed json

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

published 2026-04-07 7 mo ago modified 2026-11-04 4 d ago also EUVD-2026-19814

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
15.5%
EPSS 15.5% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:344-3.el10_1, 0:356.1-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:334.1-3.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:344-2.el9_7, 0:356.1-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:334.2-2.el9_6
  • cockpit Debian 13 337-1+deb13u1
  • cockpit Debian 14 360-1

debian advisories DEBIAN-CVE-2026-4631

  • cockpit RHEL 10.2 356.1-1.el10_2
  • cockpit-ws RHEL 10.2 356.1-1.el10_2
  • cockpit-bridge RHEL 10.2 356.1-1.el10_2
  • cockpit-system RHEL 10.2 356.1-1.el10_2
  • cockpit-storaged RHEL 10.2 356.1-1.el10_2
  • cockpit-packagekit RHEL 10.2 356.1-1.el10_2
  • cockpit-ws-selinux RHEL 10.2 356.1-1.el10_2
  • cockpit RHEL 9 356.1-1.el9_8

red hat advisories RHBA-2026:21388RHBA-2026:21387RHSA-2026:7384RHSA-2026:7382RHSA-2026:7383RHSA-2026:7381

  • cockpit-subscriptions SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 16.2-160000.1.1
  • cockpit SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 364-160000.1.1
  • cockpit-repos SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.8-160000.1.1
  • cockpit-podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 128-160000.1.1
  • cockpit-machines SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 354-160000.1.1
  • cockpit-packages SLES for SAP applications 16.0, SLES 16.0 5-160000.1.1
  • cockpit SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 354-160000.3.1

suse advisories SUSE-SU-2026:22770-1SUSE-SU-2026:22837-1SUSE-SU-2026:21106-1SUSE-SU-2026:21184-1

  • cockpit-subscriptions openSUSE Leap 16.0 16.2-160000.1.1
  • cockpit openSUSE Leap 16.0 364-160000.1.1
  • cockpit-repos openSUSE Leap 16.0 4.8-160000.1.1
  • cockpit-podman openSUSE Leap 16.0 128-160000.1.1
  • cockpit-machines openSUSE Leap 16.0 354-160000.1.1
  • cockpit-packages openSUSE Leap 16.0 5-160000.1.1
  • cockpit openSUSE Leap 16.0 354-160000.3.1
  • cockpit openSUSE Tumbleweed 360-1.1

opensuse advisories openSUSE-SU-2026:21399-1openSUSE-SU-2026:20523-1openSUSE-SU-2026:10531-1

  • cockpit-bridge AlmaLinux 10 344-3.el10_1
  • cockpit-system AlmaLinux 10 344-3.el10_1
  • cockpit-storaged AlmaLinux 10 344-3.el10_1
  • cockpit-packagekit AlmaLinux 10 344-3.el10_1
  • cockpit AlmaLinux 9 344-2.el9_7
  • cockpit-ws AlmaLinux 9 344-2.el9_7
  • cockpit-bridge AlmaLinux 9 344-2.el9_7
  • cockpit-system AlmaLinux 9 344-2.el9_7

almalinux advisories ALSA-2026:7383ALSA-2026:7384

  • cockpit Rocky Linux 10 344-3.el10_1.rocky.0.1
  • cockpit Rocky Linux 9 344-2.el9_7.rocky.0.1

rocky linux advisories RLSA-2026:7383RLSA-2026:7384

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4631 updated cvss 9.8

cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

  • Red Hat Enterprise Linux AppStream (v. 9) cockpit-storaged 344-2.el9_7, cockpit-packagekit 344-2.el9_7, cockpit-storaged 356.1-1.el9_8, cockpit-packagekit 356.1-1.el9_8
    fixed: vendor fix RHSA-2026:7384
  • Red Hat Enterprise Linux AppStream (v. 10) cockpit-storaged 344-3.el10_1, cockpit-packagekit 344-3.el10_1, cockpit-storaged 356.1-1.el10_2, cockpit-packagekit 356.1-1.el10_2
    fixed: vendor fix RHSA-2026:7383
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) cockpit-storaged 334.1-3.el10_0, cockpit-packagekit 334.1-3.el10_0
    fixed: vendor fix RHSA-2026:7381
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) cockpit-storaged 334.2-2.el9_6, cockpit-packagekit 334.2-2.el9_6
    fixed: vendor fix RHSA-2026:7382
  • Red Hat Enterprise Linux BaseOS (v. 9) cockpit 344-2.el9_7, cockpit 356.1-1.el9_8, cockpit-ws 344-2.el9_7, cockpit-ws 356.1-1.el9_8, cockpit-bridge 344-2.el9_7, cockpit-system 344-2.el9_7, +4 more
    fixed: vendor fix RHSA-2026:7384
  • Red Hat Enterprise Linux BaseOS (v. 10) cockpit 344-3.el10_1, cockpit 356.1-1.el10_2, cockpit-ws 344-3.el10_1, cockpit-ws 356.1-1.el10_2, cockpit-bridge 344-3.el10_1, cockpit-system 344-3.el10_1, +4 more
    fixed: vendor fix RHSA-2026:7383
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) cockpit 334.1-3.el10_0, cockpit-ws 334.1-3.el10_0, cockpit-bridge 334.1-3.el10_0, cockpit-system 334.1-3.el10_0
    fixed: vendor fix RHSA-2026:7381
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) cockpit 334.2-2.el9_6, cockpit-ws 334.2-2.el9_6, cockpit-bridge 334.2-2.el9_6, cockpit-system 334.2-2.el9_6
    fixed: vendor fix RHSA-2026:7382
show 1 more
  • Red Hat Enterprise Linux 7 cockpit, cockpit-ws, cockpit-bridge, cockpit-system, cockpit-machines-ovirt Red Hat Enterprise Linux 8 cockpit, cockpit-ws, cockpit-bridge, cockpit-system
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-52572)

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

15.48% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52572 Cockpit 359 - RCE webapps, 2026-05-21
  • Nuclei template Cockpit Web Console < 360 - Remote Code Execution nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.