Summary
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151)
* cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | cockpit | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-bridge | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-bridge | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-debuginfo | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-debuginfo | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-debugsource | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-debugsource | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-doc | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-system | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-ws | 0:310.10.2-1.el8_10 |
| Rocky Linux · 8 | cockpit-ws | 0:310.10.2-1.el8_10 |
Vulnerabilities 2
-
High 7.5
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…
-
High 7.3
Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…