EUVD-2026-19814Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
AnalysisAI
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
Technical ContextAI
Cockpit is Red Hat's web-based server administration interface that provides remote system management capabilities including SSH-based remote login functionality. The vulnerability stems from CWE-78 (OS Command Injection) in the remote login feature's authentication flow. When processing login requests, Cockpit accepts hostname and username parameters from the web interface and passes them directly to the underlying SSH client without input validation or sanitization. The affected CPE strings identify this issue across Red Hat Enterprise Linux 7, 8, 9, and 10 product lines. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a network-accessible vulnerability with low attack complexity requiring no privileges or user interaction. The injection point occurs during SSH client command construction, allowing attackers to break out of expected parameter contexts and inject arbitrary SSH options (such as ProxyCommand directives) or shell metacharacters that execute before the authentication handshake completes.
RemediationAI
Organizations should immediately consult Red Hat's official security advisory at https://access.redhat.com/security/cve/CVE-2026-4631 for patched package versions and apply vendor-supplied updates through standard RHEL package management (yum/dnf update cockpit). No vendor-released patch version is independently confirmed from available data at time of analysis; refer to the Red Hat advisory for exact fixed versions per RHEL release. As an immediate risk mitigation while patching, restrict network access to Cockpit's web interface (TCP port 9090) using firewall rules to allow only trusted management networks or specific IP addresses, eliminating internet exposure. Organizations not actively using Cockpit's remote login feature should disable the cockpit service entirely (systemctl stop cockpit.socket && systemctl disable cockpit.socket) until patching is complete. For environments requiring continued Cockpit access during remediation windows, implement defense-in-depth controls such as VPN-only access or jump host architectures. Verify patch application by checking installed Cockpit package versions and reviewing Red Hat's Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2450246 for additional technical guidance.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Sandbox escape in PipeWire's PulseAudio compatibility layer lets a low-privileged process inside a confined environment
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
| SUSE Linux Micro 6.2 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Micro 5.2 | Fixed |
| SUSE Linux Enterprise Micro 5.3 | Fixed |
| SUSE Linux Enterprise Micro 5.4 | Fixed |
| SUSE Linux Enterprise Micro 5.5 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| SUSE Linux Micro 6.0 | Fixed |
| SUSE Linux Micro 6.1 | Fixed |
| SUSE Linux Micro 6.2 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today