CVE-2026-92747Medium· 5.0▾ TwilightPoC availableA flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 27.5 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.2%
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as rootPassword and userPassword. This occurs when the install_machine.py script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92768Medium· 5.5A flaw was found in cockpit-machines
CVE-2026-92745Medium· 5.0A flaw was found in cockpit-machines
CVE-2026-113495Medium· 5.0Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
CVE-2026-113496Medium· 5.0Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-109971Medium· 4.7A flaw was found in the clevis PKCS#11 pin
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)