Cockpit Machines CVE-2026-113496

Three concrete prerequisites must all hold: (1) the attacker already has a local, unprivileged but authenticated account on the same host (PR:L, AV:L); (2) the host permits cross-user process inspection - i.e., /proc is NOT mounted with hidepid=2 and no equivalent process-hiding is enforced, which the description explicitly names as the enabling condition and which hardened multi-tenant systems typically disable; and (3) a second user must actively save or modify VNC console settings via cockpit-machines during the brief window the attacker is monitoring the process list (UI:R). Limiting factors: exploitation is impossible on systems using hidepid, requires concurrent victim action, is local-only (no network reachability), and yields only the guest VNC password with no integrity or availability impact.

All signals point to a genuinely low-priority, low-real-risk issue despite the HIGH confidentiality impact sub-score. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, base 5.0 Medium) establishes that exploitation requires local access (AV:L), an existing authenticated local account (PR:L), and - critically - user interaction by a SECOND user (UI:R) who must be actively saving VNC settings at the moment the attacker samples the process list. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality-only impact (C:H, I:N, A:N) is real but narrow: a single guest VNC password, not host or hypervisor compromise. The signals are internally consistent - there is no network-vs-local or privilege conflict to reconcile. The main caveat is the required host precondition: the description states exploitation depends on a host 'that allows cross-user process inspection,' meaning hardened systems with hidepid on /proc are not vulnerable at all. This is a credential-disclosure hygiene flaw (CWE-214) worth patching in multi-tenant environments but not an urgent, widely-exploitable threat.

On a shared RHEL host where multiple users have shell access and /proc is not mounted with hidepid, a local unprivileged attacker runs a tight loop polling the process list (e.g., ps/ /proc/*/cmdline). While a legitimate administrator saves VNC console settings for a guest VM through cockpit-machines, the configured password appears as a visible command-line argument to the invoked utility, and the attacker captures it. No public exploit code was identified in the provided data; the technique is trivial scripting rather than a weaponized exploit.