Moderate Vulnerability in cockpit-machines: Sensitive Data Exposure
Summary
RLSA-2026:86971: Moderate: cockpit-machines security update. Affects cockpit-machines versions < 0:348.1-1.el10_2. Fixed in 0:348.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cockpit-machines is a component of the Cockpit project, designed for managing libvirt virtual machines. It provides a user-friendly interface for system administrators to control virtual machines, monitor their performance, and manage resources effectively. However, recent vulnerabilities have been identified that expose sensitive data, potentially compromising the security of guest credentials and other critical information.
Vulnerability Detail
The vulnerabilities in cockpit-machines stem from improper handling of sensitive data, leading to exposure via command-line arguments and process lists. Specifically, CVE-2026-92768 allows sensitive data exposure through command-line arguments, while CVE-2026-92747 reveals guest credentials through JSON arguments in the process list. Additionally, CVE-2026-92745 discloses RHSM Offline Tokens via process arguments. These vulnerabilities could allow unauthorized users to access sensitive information, posing a significant security risk.
How To Fix
Minimum fixed version
0:348.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update cockpit-machinesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using command-line arguments that expose sensitive data. Additionally, consider restricting access to the system to trusted users only until the package is updated.
Conclusion
The cockpit-machines package has a moderate vulnerability that exposes sensitive data through command-line arguments and process lists. It is crucial to update the package to the latest version to mitigate these risks. Users should also consider implementing workarounds until the update can be applied.
See every vulnerability recorded for cockpit-machines →
FAQ
The CVSS score of the vulnerability is 5.5, indicating a moderate level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerabilities are associated with the following CVEs: CVE-2026-92745, CVE-2026-92747, and CVE-2026-92768.
If immediate updates are not possible, implement workarounds such as limiting access to the system and avoiding the use of command-line arguments that may expose sensitive data.
The Rocky Enterprise Software Foundation and Red Hat are responsible for addressing this vulnerability and providing necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-machines.
