Red Hat Enterprise Linux cockpit-machines: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 3

• Medium 5.5
  CVE-2026-92768

  Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments

  A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-machines Linux Debian Ubuntu
  Sep 18, 2026
• Medium 5.0
  CVE-2026-92745

  Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments

  A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-lin…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-machines Linux Debian Ubuntu
  Sep 18, 2026
• Medium 5.0
  CVE-2026-92747

  Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list

  A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `insta…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 cockpit-machines Linux Debian Ubuntu
  Sep 18, 2026

Revision history

1. 2026-11-11 #3

   Neue Updates von Red Hat aufgenommen

2. 2026-10-22 #2

   Neue Updates von Oracle Linux aufgenommen

3. 2026-10-21 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2026:86970 vom 2026-10-21
  https://access.redhat.com/errata/RHSA-2026:86970
• Red Hat Security Advisory RHSA-2026:86971 vom 2026-10-21
  https://access.redhat.com/errata/RHSA-2026:86971
• PoC für CVE-2026-4008
  https://bugzilla.redhat.com/show_bug.cgi?id=2469260
• PoC für CVE-2026-92768
  https://bugzilla.redhat.com/show_bug.cgi?id=2469258
• PoC für CVE-2026-92745
  https://bugzilla.redhat.com/show_bug.cgi?id=2476266
• Oracle Linux Security Advisory ELSA-2026-86971 vom 2026-10-21
  https://linux.oracle.com/errata/ELSA-2026-86971.html
• Oracle Linux Security Advisory ELSA-2026-86970 vom 2026-10-23
  https://linux.oracle.com/errata/ELSA-2026-86970.html
• Red Hat Security Advisory RHSA-2026:98459 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98459
• Red Hat Security Advisory RHSA-2026:98562 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98562