Description
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cockpit-machines | 357-1 | — |
| Debian 13 | cockpit-machines | No fix yet | — |
| Debian 12 | cockpit-machines | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cockpit-machines | No fix yet | — |
| Ubuntu 26.04 LTS | cockpit-machines | No fix yet | — |
| Ubuntu 24.04 LTS | cockpit-machines | No fix yet | — |
| Ubuntu 22.04 LTS | cockpit-machines | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-machines | 348.1-1.el10_2 | ALSA-2026:86971 |
| AlmaLinux 9 | cockpit-machines | 348.1-1.el9_8 | ALSA-2026:86970 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-machines | 348.1-1.el10_2 | RLSA-2026:98562, RLSA-2026:86971 |
| Rocky Linux 9 | cockpit-machines | 348.1-1.el9_8 | RLSA-2026:98459, RLSA-2026:86970 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | cockpit-machines | 348.1-1.0.1.el10_2 | ELSA-2026-86971 |
| Oracle Linux 9 | cockpit-machines | 348.1-1.0.1.el9_8 | ELSA-2026-86970 |
Advisories 9
- RLSA-2026:98562 Moderate: cockpit-machines security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:98459 Moderate: cockpit-machines security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4118 Red Hat Enterprise Linux cockpit-machines: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:86970 Moderate: cockpit-machines security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:86971 Moderate: cockpit-machines security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:86971 Moderate: cockpit-machines security update Rocky Linux Security Advisories · Oct 22, 2026
- RLSA-2026:86970 Moderate: cockpit-machines security update Rocky Linux Security Advisories · Oct 22, 2026
- ELSA-2026-86970 Moderate: cockpit-machines security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 22, 2026
- ELSA-2026-86971 Moderate: cockpit-machines security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 21, 2026
References
- RHSA-2026:86970 vendor-advisory
- RHSA-2026:86971 vendor-advisory
- RHSA-2026:98459 vendor-advisory
- RHSA-2026:98562 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-92768 vdb-entry
- RHBZ#2469258 issue-tracking