PT-2026-30912 · Red Hat+1 · Cockpit+1
Florian Kohnhäuser
·
Published
2026-03-23
·
Updated
2026-07-13
·
CVE-2026-4631
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cockpit versions prior to 360
Description
The remote login feature in Cockpit fails to validate or sanitize user-supplied hostnames and usernames passed from the web interface to the SSH client. An attacker with network access to the web service can send a single HTTP request to the login endpoint to inject malicious SSH options or shell commands, such as using
ProxyCommand, leading to remote code execution on the host. This occurs during the authentication flow before credential verification, allowing the attack to be carried out without valid credentials. Approximately 1.3 million services are estimated to be potentially affected worldwide.Recommendations
Update Cockpit to version 360.
Exploit
Fix
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cockpit
Rocky Linux