Cockpit Machines CVE-2026-113495

Requires: (1) a local, unprivileged shell account on the affected host; (2) the system must permit cross-user process inspection - i.e. /proc is not mounted with hidepid=2 (the hardened setting), which is the default on many RHEL installs; (3) a concurrent image-retrieval operation in cockpit-machines by another user that spawns the helper process with the RHSM token in its argv (the UI:R requirement). Limiting factors: exploitation is purely LOCAL (no remote vector), succeeds only during the narrow window the helper process is active, and the stolen token is useful only within its RHSM validity period. Hosts with hidepid enabled or without cockpit-machines in use are not exposed.

This is a moderate-risk, low-urgency issue, not a top priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, base 5.0) is internally consistent with the description: exploitation is LOCAL, requires an existing unprivileged account (PR:L), and depends on a legitimate user performing an image-retrieval action (UI:R) while the attacker observes the process table. The sole impact is confidentiality (C:H) via disclosure of an RHSM authentication token; there is no integrity or availability impact (I:N/A:N). No EPSS score, CISA KEV listing, POC, or SSVC data was provided, so there is no signal of active exploitation or automatable mass exploitation - consistent with a local race-condition information leak rather than a wormable remote flaw. Exploitation status: no public exploit identified at time of analysis. Note a data caveat: the input Tag 'Authentication Bypass' conflicts with the actual weakness (CWE-214, exposure of sensitive information via process arguments) - this is an information-disclosure flaw that could *enable* downstream unauthorized RHSM access, not an authentication bypass; treat the tag as mislabeled.

On a multi-user RHEL 9/10 host where /proc is not hardened (hidepid disabled, the common default), an unprivileged local user polls the process list while an administrator uses cockpit-machines to pull an image. During the brief window the helper process is running, the attacker reads the RHSM token from its command-line arguments and reuses it to access RHSM resources until it expires. No public exploit code is known, but the technique is trivial to script and requires no special tooling.