CVE-2026-92768
CVE-2026-92768 · Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
CVSS 5.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:348.1-1.el10_2: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:348.1-1.el9_8: Not affected (rpm)
No fix published
cockpit-machines Debian:12
- Versions
- 288-1
- 292-1
- 293-1
- 294-1
- 295-1
- 295-1~bpo12+1
- 296-1
- 297-1
- 297-1~bpo12+1
- 298-1
- 298-1~bpo12+1
- 299-1
- 299-1~bpo12+1
- 300-1
- 300-1~bpo12+1
- 301-1
- 302-1
- 302-1~bpo12+1
- 303-1
- 303-1~bpo12+1
- 304-1
- 304-1~bpo12+1
- 305-1
- 305-1~bpo12+1
- 306-1
- 307-1
- 307-1~bpo12+1
- 309-1
- 309-1~bpo12+1
- 310-1
- 310-1~bpo12+1
- 312-1
- 313-1
- 313-2
- 313-3
- 314-1
- 314-2
- 314-2~bpo12+1
- 315-1
- 315-1~bpo12+1
- 316-1
- 317-1
- 317-1~bpo12+1
- 318-1
- 318-1~bpo12+1
- 319-1
- 319-1~bpo12+1
- 320-1
- 320-1~bpo12+1
- 321-1
- 322-1
- 323-1
- 323-1~bpo12+1
- 324-1
- 324-1~bpo12+1
- 325-1
- 325-2
- 326-1
- 327-1
- 327-1~bpo12+1
- 328-1
- 329-1
- 329-1~bpo12+1
- 330-1
- 331-1
- 332-1
- 332-1~bpo12+1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1
- 357-1~bpo13+1
- 359-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Debian:13
- Versions
- 332-1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1
- 357-1~bpo13+1
- 359-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Debian:14
- Versions
- 332-1
- 334-1
- 335-1
- 336-1
- 338-1
- 338-1~bpo13+1
- 339-1
- 339-1~bpo13+1
- 341-1
- 341-1~bpo13+1
- 343-1
- 343-1~bpo13+1
- 345-1
- 345-1~bpo13+1
- 346-1
- 346-1~bpo13+1
- 347-1
- 347-1~bpo13+1
- 348-1
- 348-1~bpo13+1
- 350-1
- 350-1~bpo13+1
- 351-1
- 351-1~bpo13+1
- 353-1
- 353-2
- 353-3
- 353-3~bpo13+1
- 355-1
- 355-1~bpo13+1
- 356-1
- 356-1~bpo13+1
- 357-1~bpo13+1
- Affected ranges
- ECOSYSTEM: < 357-1
Update to 357-1
cockpit-machines Ubuntu:22.04:LTS
- Versions
- 251-1
- 254-1
- 255-1
- 256-1
- 258-1
- 259-1
- 260-1
- 261-1
- 262-1
- 263-1
- 264-1
- 265-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:24.04:LTS
- Versions
- 299-1
- 300-1
- 301-1
- 302-1
- 303-1
- 304-1
- 305-1
- 306-1
- 307-1
- 310-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:26.10
- Versions
- 351-1
- 353-3
- 355-1
- 355-1ubuntu1
- 356-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit-machines Ubuntu:26.04:LTS
- Versions
- 339-1
- 341-1
- 343-1
- 345-1
- 346-1
- 347-1
- 348-1
- 351-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published