Skip to content
Fencer Vulns
high 8.0

CVE-2026-4802 json

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

published 2026-05-11 5 mo ago modified 2026-11-04 4 d ago also EUVD-2026-29051

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:356.2-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:334.2-1.el10_0
  • Red Hat Red Hat Enterprise Linux 8 0:310.8-1.el8_10
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:264.3-1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:264.3-1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:264.3-1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:286.2-1.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:286.2-1.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:356.2-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:264.3-1.el9_0
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:286.3-1.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:311.3-1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:334.3-1.el9_6
  • cockpit Debian 13 337-1+deb13u2
  • cockpit Debian 14 362-1

debian advisories DEBIAN-CVE-2026-4802

  • cockpit RHEL 8 310.8-1.el8_10
  • cockpit-ws RHEL 8 310.8-1.el8_10
  • cockpit-bridge RHEL 8 310.8-1.el8_10
  • cockpit-system RHEL 8 310.8-1.el8_10
  • cockpit RHEL 10.2 356.2-1.el10_2
  • cockpit-ws RHEL 10.2 356.2-1.el10_2
  • cockpit-bridge RHEL 10.2 356.2-1.el10_2
  • cockpit-system RHEL 10.2 356.2-1.el10_2

red hat advisories RHSA-2026:21700RHSA-2026:21676RHSA-2026:21392RHSA-2026:21647RHSA-2026:21515RHSA-2026:21516

  • cockpit-subscriptions SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 16.2-160000.1.1
  • cockpit SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 364-160000.1.1
  • cockpit-repos SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.8-160000.1.1
  • cockpit-podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 128-160000.1.1
  • cockpit-machines SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 354-160000.1.1
  • cockpit-packages SLES for SAP applications 16.0, SLES 16.0 5-160000.1.1
  • cockpit SLE Micro 5.5 298-150500.3.12.1

suse advisories SUSE-SU-2026:22770-1SUSE-SU-2026:22837-1SUSE-SU-2026:2363-1

  • cockpit-subscriptions openSUSE Leap 16.0 16.2-160000.1.1
  • cockpit openSUSE Leap 16.0 364-160000.1.1
  • cockpit-repos openSUSE Leap 16.0 4.8-160000.1.1
  • cockpit-podman openSUSE Leap 16.0 128-160000.1.1
  • cockpit-machines openSUSE Leap 16.0 354-160000.1.1
  • cockpit-packages openSUSE Leap 16.0 5-160000.1.1
  • cockpit openSUSE Leap 16.0 354-160000.4.1
  • cockpit openSUSE Tumbleweed 361-1.1

opensuse advisories openSUSE-SU-2026:21399-1openSUSE-SU-2026:21208-1openSUSE-SU-2026:10819-1

  • cockpit AlmaLinux 10 356.2-1.el10_2
  • cockpit-ws AlmaLinux 10 356.2-1.el10_2
  • cockpit-bridge AlmaLinux 10 356.2-1.el10_2
  • cockpit-system AlmaLinux 10 356.2-1.el10_2
  • cockpit-storaged AlmaLinux 10 356.2-1.el10_2
  • cockpit-packagekit AlmaLinux 10 356.2-1.el10_2
  • cockpit-ws-selinux AlmaLinux 10 356.2-1.el10_2
  • cockpit AlmaLinux 8 310.8-1.el8_10

almalinux advisories ALSA-2026:21676ALSA-2026:21700ALSA-2026:21468

  • cockpit Rocky Linux 10 356.2-1.el10_2.rocky.0.1
  • cockpit Rocky Linux 9 356.2-1.el9_8.rocky.0.1
  • cockpit Rocky Linux 8 310.8-1.el8_10

rocky linux advisories RLSA-2026:21676RLSA-2026:21468RLSA-2026:21700

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-4802 updated cvss 8.0

cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI

  • Red Hat Enterprise Linux AppStream (v. 9) cockpit-storaged 356.2-1.el9_8, cockpit-packagekit 356.2-1.el9_8
    fixed: vendor fix RHSA-2026:21468
  • Red Hat Enterprise Linux AppStream (v. 10) cockpit-storaged 356.2-1.el10_2, cockpit-packagekit 356.2-1.el10_2
    fixed: vendor fix RHSA-2026:21676
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) cockpit-pcp 264.3-1.el9_0, cockpit-storaged 264.3-1.el9_0, cockpit-packagekit 264.3-1.el9_0
    fixed: vendor fix RHSA-2026:21395
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) cockpit-pcp 286.3-1.el9_2, cockpit-storaged 286.3-1.el9_2, cockpit-packagekit 286.3-1.el9_2
    fixed: vendor fix RHSA-2026:21394
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) cockpit-storaged 334.2-1.el10_0, cockpit-packagekit 334.2-1.el10_0
    fixed: vendor fix RHSA-2026:21390
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) cockpit-pcp 311.3-1.el9_4, cockpit-storaged 311.3-1.el9_4, cockpit-packagekit 311.3-1.el9_4
    fixed: vendor fix RHSA-2026:21647
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) cockpit-storaged 334.3-1.el9_6, cockpit-packagekit 334.3-1.el9_6
    fixed: vendor fix RHSA-2026:21392
  • Red Hat Enterprise Linux BaseOS (v. 8) cockpit 310.8-1.el8_10, cockpit-ws 310.8-1.el8_10, cockpit-bridge 310.8-1.el8_10, cockpit-system 310.8-1.el8_10
    fixed: vendor fix RHSA-2026:21700
show 12 more
  • Red Hat Enterprise Linux BaseOS (v. 9) cockpit 356.2-1.el9_8, cockpit-ws 356.2-1.el9_8, cockpit-bridge 356.2-1.el9_8, cockpit-system 356.2-1.el9_8, cockpit-ws-selinux 356.2-1.el9_8
    fixed: vendor fix RHSA-2026:21468
  • Red Hat Enterprise Linux BaseOS (v. 10) cockpit 356.2-1.el10_2, cockpit-ws 356.2-1.el10_2, cockpit-bridge 356.2-1.el10_2, cockpit-system 356.2-1.el10_2, cockpit-ws-selinux 356.2-1.el10_2
    fixed: vendor fix RHSA-2026:21676
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) cockpit 264.3-1.el8_6, cockpit-ws 264.3-1.el8_6, cockpit-bridge 264.3-1.el8_6, cockpit-system 264.3-1.el8_6 Red Hat Enterprise Linux BaseOS E4S (v.8.6) cockpit 264.3-1.el8_6, cockpit-ws 264.3-1.el8_6, cockpit-bridge 264.3-1.el8_6, cockpit-system 264.3-1.el8_6
    fixed: vendor fix RHSA-2026:21516
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) cockpit 286.2-1.el8_8, cockpit-ws 286.2-1.el8_8, cockpit-bridge 286.2-1.el8_8, cockpit-system 286.2-1.el8_8
    fixed: vendor fix RHSA-2026:21515
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) cockpit 264.3-1.el9_0, cockpit-ws 264.3-1.el9_0, cockpit-bridge 264.3-1.el9_0, cockpit-system 264.3-1.el9_0
    fixed: vendor fix RHSA-2026:21395
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) cockpit 286.3-1.el9_2, cockpit-ws 286.3-1.el9_2, cockpit-bridge 286.3-1.el9_2, cockpit-system 286.3-1.el9_2
    fixed: vendor fix RHSA-2026:21394
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) cockpit 334.2-1.el10_0, cockpit-ws 334.2-1.el10_0, cockpit-bridge 334.2-1.el10_0, cockpit-system 334.2-1.el10_0
    fixed: vendor fix RHSA-2026:21390
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) cockpit 311.3-1.el9_4, cockpit-ws 311.3-1.el9_4, cockpit-bridge 311.3-1.el9_4, cockpit-system 311.3-1.el9_4
    fixed: vendor fix RHSA-2026:21647
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) cockpit 334.3-1.el9_6, cockpit-ws 334.3-1.el9_6, cockpit-bridge 334.3-1.el9_6, cockpit-system 334.3-1.el9_6
    fixed: vendor fix RHSA-2026:21392
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) cockpit 264.3-1.el8_6, cockpit-ws 264.3-1.el8_6, cockpit-bridge 264.3-1.el8_6, cockpit-system 264.3-1.el8_6
    fixed: vendor fix RHSA-2026:21516
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) cockpit 286.2-1.el8_8, cockpit-ws 286.2-1.el8_8, cockpit-bridge 286.2-1.el8_8, cockpit-system 286.2-1.el8_8
    fixed: vendor fix RHSA-2026:21515
  • Red Hat Enterprise Linux 7 cockpit, cockpit-ws, cockpit-bridge, cockpit-system, cockpit-machines-ovirt
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.