p PatchFirst

CVE-2026-4631

CVE-2026-4631 · Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

CVSS 9.8 · Critical · EPSS 15.5% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:344-3.el10_1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 10

    Versions
    • ≥ 0:356.1-1.el10_2: Not affected (rpm)

    No fix published

  • red hat enterprise linux 10.0 extended update support

    Versions
    • ≥ 0:334.1-3.el10_0: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:356.1-1.el9_8: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:344-2.el9_7: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9.6 extended update support

    Versions
    • ≥ 0:334.2-2.el9_6: Not affected (rpm)

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 8

    No fix published

  • cockpit Debian:13

    Versions
    • 337-1
    Affected ranges
    • ECOSYSTEM: < 337-1+deb13u1

    Update to 337-1+deb13u1

  • cockpit Debian:14

    Versions
    • 337-1
    • 338-1
    • 339-1
    • 340-1
    • 341.1-1
    • 342-1
    • 343-1
    • 345-1
    • 345-1~bpo13+1
    • 346-1
    • 346-1~bpo13+1
    • 348-1
    • 348-1~bpo13+1
    • 350-1
    • 350-1~bpo13+1
    • 352-1
    • 352-1~bpo13+1
    • 353.1-1
    • 353.1-1~bpo13+1
    • 354-1
    • 354-1~bpo13+1
    • 355-1
    • 355-1~bpo13+1
    • 356-1
    • 356-1~bpo13+1
    • 358-1
    • 358-1~bpo13+1
    • 360-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 360-1

    Update to 360-1

  • cockpit Ubuntu:18.04:LTS

    Versions
    • 151-1
    • 156-1
    • 157-1
    • 158-1
    • 160-1
    • 161-1
    • 162-1
    • 163-1
    • 164-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:20.04:LTS

    Versions
    • 202.1-1
    • 204-1
    • 206-1
    • 207-1
    • 208-1
    • 210-1
    • 211-1
    • 212-1
    • 213-1
    • 214.1-1
    • 215-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:22.04:LTS

    Versions
    • 252-1
    • 256-1
    • 257-1
    • 258-1
    • 259-1
    • 260-1
    • 261-1
    • 262-1
    • 263-1
    • 264-1
    • 264-1ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:24.04:LTS

    Versions
    • 300.1-1
    • 303-1
    • 304-1
    • 305-1
    • 306-1
    • 307-1
    • 308-1
    • 309-1
    • 310.1-1
    • 311-1
    • 312-1build2
    • 314-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:25.10

    Versions
    • 333-1
    • 337-1
    • 339-1
    • 342-1
    • 343-1
    • 345-1
    • 346-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:26.10

    Versions
    • 360-1
    • 362-1
    • 365-1
    • 367-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cockpit Ubuntu:26.04:LTS

    Versions
    • 346-1
    • 348-1
    • 350-1
    • 352-1
    • 353.1-1
    • 354-1
    • 355-1
    • 356-1
    • 360-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →