Description
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cockpit | 360-1 | — |
| Debian 13 | cockpit | 337-1+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cockpit | No fix yet | — |
| Ubuntu 25.10 | cockpit | No fix yet | — |
| Ubuntu 20.04 LTS | cockpit | No fix yet | — |
| Ubuntu 18.04 LTS | cockpit | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cockpit +7 | 344-3.el10_1 | RHSA-2026:7383, RHBA-2026:21388 |
| RHEL 9 | cockpit +7 | 344-2.el9_7 | RHSA-2026:7384, RHBA-2026:21387 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | cockpit +6 | 334.1-3.el10_0 | RHSA-2026:7381 |
| RHEL 9.6 EUS | cockpit +6 | 334.2-2.el9_6 | RHSA-2026:7382 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-doc +4 | 344-3.el10_1 | ALSA-2026:7383 |
| AlmaLinux 9 | cockpit +7 | 344-2.el9_7 | ALSA-2026:7384 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit | 344-3.el10_1.rocky.0.1 | RLSA-2026:7383 |
| Rocky Linux 9 | cockpit | 344-2.el9_7.rocky.0.1 | RLSA-2026:7384 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cockpit | 354-160000.3.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21184-1 |
| SLES for SAP 16.0 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES for SAP 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit | 354-160000.3.1 | SUSE-SU-2026:22837-1, SUSE-SU-2026:21184-1 |
| SLES 16.0 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-packages | 5-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLES 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22837-1 |
| SLE Micro 6.2 | cockpit | 354-160000.3.1 | SUSE-SU-2026:22770-1, SUSE-SU-2026:21106-1 |
| SLE Micro 6.2 | cockpit-machines | 354-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-podman | 128-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-repos | 4.8-160000.1.1 | SUSE-SU-2026:22770-1 |
| SLE Micro 6.2 | cockpit-subscriptions | 16.2-160000.1.1 | SUSE-SU-2026:22770-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cockpit | 360-1.1 | openSUSE-SU-2026:10531-1 |
| openSUSE Leap 16.0 | cockpit | 354-160000.3.1 | openSUSE-SU-2026:21399-1, openSUSE-SU-2026:20523-1 |
| openSUSE Leap 16.0 | cockpit-machines | 354-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-packages | 5-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-podman | 128-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-repos | 4.8-160000.1.1 | openSUSE-SU-2026:21399-1 |
| openSUSE Leap 16.0 | cockpit-subscriptions | 16.2-160000.1.1 | openSUSE-SU-2026:21399-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | cockpit +7 | 344-3.0.1.el10_1 | ELSA-2026-7383 |
| Oracle Linux 9 | cockpit +7 | 344-2.0.1.el9_7 | ELSA-2026-7384 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Cockpit 359 - RCE EDB-52572 · webapps · May 21, 2026
GitHub 2 repositories
-
cyberheartmi9/CVE-2026-4631-cockpit-RCE ★ 15 · Apr 18, 2026
Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection
-
ExDev994/CVE-2026-4631-cockpit-RCE ★ 0 · Jul 12, 2026
Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Cockpit Web Console < 360 - Remote Code Execution http/cves/2026/CVE-2026-4631.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 20
- ALSA-2026:7384 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:7383 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection AlmaLinux Security Advisories · Oct 29, 2026
- RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHBA-2026:21388 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7384 Red Hat Security Advisory: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7383 Red Hat Security Advisory: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7381 Red Hat Security Advisory: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7382 Red Hat Security Advisory: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Red Hat Security Advisories (RHSA) · Oct 16, 2026
- SUSE-SU-2026:22837-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 28, 2026
- WID-SEC-2026-1052 Red Hat Enterprise Linux (Cockpit): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 27, 2026
- openSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22770-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions SUSE / openSUSE Security Updates · Jul 23, 2026
- RLSA-2026:7383 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Rocky Linux Security Advisories · May 21, 2026
- RLSA-2026:7384 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection Rocky Linux Security Advisories · May 21, 2026
- openSUSE-SU-2026:20523-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21184-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21106-1 Security update for cockpit SUSE / openSUSE Security Updates · Apr 17, 2026
- ELSA-2026-7383 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Apr 14, 2026
- openSUSE-SU-2026:10531-1 cockpit-360-1.1 on GA media SUSE / openSUSE Security Updates · Apr 12, 2026
- ELSA-2026-7384 Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 10, 2026
References
- RHBA-2026:21387 vendor-advisory
- RHBA-2026:21388 vendor-advisory
- RHSA-2026:7381 vendor-advisory
- RHSA-2026:7382 vendor-advisory
- RHSA-2026:7383 vendor-advisory
- RHSA-2026:7384 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-4631 vdb-entry
- RHBZ#2450246 issue-tracking
- https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427