Summary
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | cockpit | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-bridge | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-doc | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-packagekit | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-storaged | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-system | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-ws | 356.2-1.el9_8 |
| AlmaLinux · 9 | cockpit-ws-selinux | 356.2-1.el9_8 |
Vulnerabilities 1
-
High 8.0CVE-2026-4802 Public exploit
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can injec…