Critical Unauthenticated Remote Code Execution Vulnerability in Cockpit
Summary
ALSA-2026:7383: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection. Affects cockpit versions < 344-3.el10_1. Fixed in 344-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cockpit is a web-based interface that allows users to administer GNU/Linux servers efficiently. It provides functionalities such as network configuration, log inspection, diagnostic reports, SELinux troubleshooting, and interactive command-line sessions. This makes it a vital tool for system administrators. However, a recent vulnerability has been identified that could allow unauthorized users to execute arbitrary commands remotely.
Vulnerability Detail
The vulnerability arises from improper handling of SSH command-line arguments, which can lead to unauthenticated remote code execution. Specifically, the issue is linked to how hostnames are processed in the Cockpit web service. If exploited, an attacker could potentially execute commands on the server without any authentication, posing a significant security risk.
How To Fix
Minimum fixed version
344-3.el10_1
This is the first release that contains the fix.
sudo dnf update cockpitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Cockpit web interface by configuring your firewall to limit connections to trusted IP addresses only. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
The identified vulnerability in Cockpit poses a critical risk of unauthenticated remote code execution. It is crucial for users to update their packages to the latest patched version to safeguard their systems. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for cockpit →
FAQ
Cockpit is a web-based server management tool that allows users to administer GNU/Linux servers through a browser.
This vulnerability allows an attacker to execute arbitrary commands on the server without authentication, potentially compromising the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider restricting access to the Cockpit interface by limiting connections to trusted IP addresses.
More information can be found on the CVE page associated with this vulnerability, CVE-2026-4631.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit.
