cockpit-appstream vulnerabilities
CVEs whose affected-version data names the cockpit-appstream package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113496Medium· 5.0Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a…
▾ SunlitRed Hat · cockpit-machinesEPSS 0.14%via CVEORG
CVE-2026-113495Medium· 5.0Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a…
▾ SunlitRed Hat · cockpit-machinesEPSS 0.16%via CVEORG