cockpit-ws CVE-2026-76235

The triggering condition is an HTTP request to the cockpit-ws login page endpoint that includes a CockpitLang cookie - this is a standard HTTP cookie that any HTTP client can set without authentication or any special privilege. The CockpitLang cookie is a locale-selection mechanism available to unauthenticated visitors by design, meaning no special server-side configuration is required beyond cockpit-ws being running and reachable. Exploitation is limited by network accessibility: cockpit-ws listens on TCP 9090, which is often firewalled to administrative networks on hardened deployments; if internet-exposed, the service is reachable by any external attacker. There is no required authentication, no required user interaction, and no non-default configuration state needed - the vulnerable code path is exercised by the default login page handler on every RHEL system running cockpit.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the core risk profile: trivially reachable over the network with no authentication, no complexity, and no user interaction required, with high availability impact. The sole impact is availability - there is no confidentiality or integrity exposure. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified from available sources. KEV status is not listed, and no POC has been identified, meaning active exploitation is not confirmed. The practical threat model is an attacker deliberately flooding the cockpit-ws login endpoint with CockpitLang-bearing requests to exhaust host memory, which could also affect other services running on the same host given shared memory. Because cockpit-ws is typically exposed only to internal networks or administrative interfaces rather than the public internet, real-world exposure is often reduced despite the unauthenticated network vector - defenders should verify whether cockpit-ws is internet-accessible in their environments.

An attacker with network access to cockpit-ws (default port 9090) scripted a loop sending HTTP GET requests to the cockpit login page, each carrying an arbitrary CockpitLang cookie value, at high volume. With no authentication or special knowledge required beyond the cookie name, the attacker sustained the flood, causing the cockpit-ws heap to grow unboundedly until the host OOM killer terminated the process - or other memory-resident services on the host began failing. No public POC has been identified, but the exploitation technique is straightforward to reproduce from the description alone.