---
id: CVE-2024-6126
title: >-
  Cockpit: authenticated user can kill any process when enabling pam_env's
  user_readenv option
summary: >-
  A flaw was found in the cockpit package. This flaw allows an authenticated
  user to kill any process when enabling the pam_env's user_readenv option,
  which leads to a denial of service (DoS) attack.
severity: low
cvss: 3.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-400
vendor: Red Hat
product: cockpit
affected:
  - cockpit (all versions)
  - cockpit (all versions)
  - cockpit (all versions)
  - cockpit
  - cockpit
  - cockpit (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-07-08T14:14:09.489434Z'
published: '2024-07-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T11:32:25.041Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-6126'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:9325'
    label: 'RHSA-2024:9325'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-6126'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2292897'
    label: RHBZ#2292897
tags:
  - cve.org
epss: 0.00274
epssPercentile: 0.19881
ingestedAt: '2026-11-07T12:16:41.113Z'
---

## Overview

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

## Affected

- `cockpit (all versions)`
- `cockpit (all versions)`
- `cockpit (all versions)`
- `cockpit`
- `cockpit`
- `cockpit (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Disable pam_env's `user_readenv` option in PAM config.