Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by redhat

CVE-2026-91202Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

Medium 6.1

In plain English

A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.1%top 97.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10cockpit-files36.1-1.el10_2ALSA-2026:95570
AlmaLinux:9cockpit-files36.1-1.el9_8ALSA-2026:84595
Debian:14cockpit-files45-1DEBIAN-CVE-2026-91202
Rocky Linux:10cockpit-files0:36.1-1.el10_2RLSA-2026:95570
Rocky Linux:9cockpit-files0:36.1-1.el9_8RLSA-2026:84595
Ubuntu:26.04:LTScockpit-filesno fix listedUBUNTU-CVE-2026-91202
Ubuntu:26.10cockpit-filesno fix listedUBUNTU-CVE-2026-91202

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 10 see references

Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

References