CVE-2026-92747
CVE-2026-92747 · Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
CVSS 5.0 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:348.1-1.el10_2: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:348.1-1.el9_8: Not affected (rpm)
No fix published
cockpit-machines Debian:12
- Versions
- 288-1
- 292-1
- 293-1
- 294-1
- 295-1
- 295-1~bpo12+1
- 296-1
- 297-1
- 297-1~bpo12+1
- 298-1
- 298-1~bpo12+1
- 299-1
- 299-1~bpo12+1
- 300-1
- 300-1~bpo12+1
- 301-1
- 302-1
- 302-1~bpo12+1
- 303-1
- 303-1~bpo12+1
- 304-1
- 304-1~bpo12+1
- 305-1
- 305-1~bpo12+1
- 306-1
- 307-1
- 307-1~bpo12+1
- 309-1
- 309-1~bpo12+1
- 310-1
- 310-1~bpo12+1
- 312-1
- 313-1
- 313-2
- 313-3
- 314-1
- 314-2
- 314-2~bpo12+1
- 315-1
- 315-1~bpo12+1
- 316-1
- 317-1
- 317-1~bpo12+1
- 318-1
- 318-1~bpo12+1
- 319-1
- 319-1~bpo12+1
- 320-1
- 320-1~bpo12+1
- 321-1
- 322-1
- 323-1
- 323-1~bpo12+1
- 324-1
- 324-1~bpo12+1
- 325-1
- 325-2
- 326-1
- 327-1
- 327-1~bpo12+1
- 328-1
- 329-1
- 329-1~bpo12+1
- 330-1
- 331-1
- 332-1
- 332-1~bpo12+1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1
- 357-1~bpo13+1
- 359-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Debian:13
- Versions
- 332-1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1
- 357-1~bpo13+1
- 359-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Debian:14
- Versions
- 332-1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1~bpo13+1
- Affected ranges
- ECOSYSTEM: < 357-1
Update to 357-1
cockpit-machines Ubuntu:22.04:LTS
- Versions
- 251-1
- 254-1
- 255-1
- 256-1
- 258-1
- 259-1
- 260-1
- 261-1
- 262-1
- 263-1
- 264-1
- 265-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:24.04:LTS
- Versions
- 299-1
- 300-1
- 301-1
- 302-1
- 303-1
- 304-1
- 305-1
- 306-1
- 307-1
- 310-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:26.10
- Versions
- 351-1
- 353-3
- 355-1
- 355-1ubuntu1
- 356-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:26.04:LTS
- Versions
- 339-1
- 341-1
- 343-1
- 345-1
- 346-1
- 347-1
- 348-1
- 351-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published