Log in Start free

Vulnerability · Published Apr 7, 2026 · Assigned by redhat

CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

Critical 9.8

In plain English

A critical-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.5% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)15.5%top 3.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9cockpit344-2.el9_7ALSA-2026:7384
AlmaLinux:10cockpit-bridge344-3.el10_1ALSA-2026:7383
AlmaLinux:9cockpit-bridge344-2.el9_7ALSA-2026:7384
AlmaLinux:10cockpit-doc344-3.el10_1ALSA-2026:7383
AlmaLinux:9cockpit-doc344-2.el9_7ALSA-2026:7384
AlmaLinux:10cockpit-packagekit344-3.el10_1ALSA-2026:7383
AlmaLinux:9cockpit-packagekit344-2.el9_7ALSA-2026:7384
AlmaLinux:10cockpit-storaged344-3.el10_1ALSA-2026:7383
AlmaLinux:9cockpit-storaged344-2.el9_7ALSA-2026:7384
AlmaLinux:10cockpit-system344-3.el10_1ALSA-2026:7383
AlmaLinux:9cockpit-system344-2.el9_7ALSA-2026:7384
AlmaLinux:9cockpit-ws344-2.el9_7ALSA-2026:7384
AlmaLinux:9cockpit-ws-selinux344-2.el9_7ALSA-2026:7384
Debian:13cockpit337-1+deb13u1DEBIAN-CVE-2026-4631
Debian:14cockpit360-1DEBIAN-CVE-2026-4631
Rocky Linux:10cockpit0:344-3.el10_1.rocky.0.1RLSA-2026:7383
Rocky Linux:9cockpit0:344-2.el9_7.rocky.0.1RLSA-2026:7384
Ubuntu:22.04:LTScockpitno fix listedUBUNTU-CVE-2026-4631
Ubuntu:24.04:LTScockpitno fix listedUBUNTU-CVE-2026-4631
Ubuntu:25.10cockpitno fix listedUBUNTU-CVE-2026-4631
Ubuntu:26.04:LTScockpitno fix listedUBUNTU-CVE-2026-4631
Ubuntu:26.10cockpitno fix listedUBUNTU-CVE-2026-4631

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References