CVE-2026-4802High· 8.0▾ MidnightPoC availableA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI).…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.0%
1 GitHub repo (last check)
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpit (all versions)cockpitRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Operational risk reduction until fixes are available: restrict access to Cockpit to trusted networks/users only, and avoid opening untrusted crafted Cockpit URLs
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4631Critical· 9.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization
CVE-2026-91147Medium· 5.9A flaw was found in `cockpit-ws`
CVE-2024-6126Low· 3.2Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option
CVE-2026-121621High· 8.8Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration
CVE-2024-2947High· 7.3Cockpit: command injection when deleting a sosreport with a crafted name
CVE-2026-76235High· 7.5Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html