Skip to content
OpenAdvisories
Critical RHBA-2026:21388 3 CVEs

Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Published Oct 16, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-bridge 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-debuginfo 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-debugsource 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-doc 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-packagekit 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-storaged 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-system 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-ws 0:356.1-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-ws-selinux 0:356.1-1.el10_2

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-4631 Public exploit Scanner template EPSS 15%

    Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

    Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login en…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm
  • Medium 6.5
    CVE-2026-2950

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_21388.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-2950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453499
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-2950
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-2950
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
  • report
    https://access.redhat.com/security/cve/CVE-2026-4631
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2450246
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-4631
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-4631
  • article
    https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427
  • report
    https://access.redhat.com/security/cve/CVE-2026-4800
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453496
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-4800
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-4800
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc