Skip to content
Fencer Vulns
medium 6.0

CVE-2026-91205 json

Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race

published 2026-09-18 51 d ago modified 2026-11-06 3 d ago also EUVD-2026-83291

cvss
6.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:36.1-1.el10_2
  • Red Hat Red Hat Enterprise Linux 9 0:36.1-1.el9_8
  • cockpit-files Debian 14 45-1

debian advisories DEBIAN-CVE-2026-91205

  • cockpit-files RHEL 9 36.1-1.el9_8

red hat advisories RHSA-2026:84595

  • cockpit-files AlmaLinux 10 36.1-1.el10_2
  • cockpit-files AlmaLinux 9 36.1-1.el9_8

almalinux advisories ALSA-2026:95570ALSA-2026:84595

  • cockpit-files Rocky Linux 10 36.1-1.el10_2
  • cockpit-files Rocky Linux 9 36.1-1.el9_8

rocky linux advisories RLSA-2026:95570RLSA-2026:84595

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-91205 updated cvss 6.0

cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race

  • Red Hat Enterprise Linux AppStream (v. 9) cockpit-files 36.1-1.el9_8
    fixed: vendor fix RHSA-2026:84595
  • Red Hat Enterprise Linux AppStream (v. 10) cockpit-files 36.1-1.el10_2
    fixed: vendor fix RHSA-2026:95570

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
48 d ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-363 Race Condition Enabling Link Following

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.