cockpit-machines vulnerabilities
CVEs whose affected-version data names the cockpit-machines package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-113496Medium· 5.0Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a…
CVE-2026-113495Medium· 5.0Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a…
CVE-2026-92768Medium· 5.5PoCA flaw was found in cockpit-machines
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or inst…
CVE-2026-92747Medium· 5.0PoCA flaw was found in `cockpit-machines`
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This …
CVE-2026-92745Medium· 5.0A flaw was found in cockpit-machines
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is p…