Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream | cockpit-debuginfo | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream | cockpit-debugsource | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream | cockpit-packagekit | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream | cockpit-pcp | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream | cockpit-storaged | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-bridge | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-debuginfo | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-debugsource | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-doc | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-system | 0:264.3-1.el9_0 |
| Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos | cockpit-ws | 0:264.3-1.el9_0 |
Vulnerabilities 1
-
High 8.0CVE-2026-4802 Public exploit
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can injec…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2451155
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21395.json
-
report
https://access.redhat.com/security/cve/CVE-2026-4802
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-4802
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4802
-
article
https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx#L206-L210