Summary
Cockpit enables users to administer GNU/Linux servers using a web browser. It
offers network configuration, log inspection, diagnostic reports, SELinux
troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | cockpit | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-bridge | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-doc | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-packagekit | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-storaged | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-system | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-ws | 344-2.el9_7 |
| AlmaLinux · 9 | cockpit-ws-selinux | 344-2.el9_7 |
Vulnerabilities 1
-
Critical 9.8
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login en…