Cockpit CVE-2026-91149

Requires network reachability to the cockpit-tls service (the TLS front-end of the Cockpit web console, default TCP 9090) and the ability to open and sustain many concurrent connections; no authentication, user interaction, or non-default configuration is needed, so it works against default Cockpit deployments where the port is exposed to the attacker. The main limiting factor is exposure: cockpit-tls must be reachable from the attacker's network position (internet-facing or same LAN/management network), and impact is confined to denial of service of the management console rather than the underlying host services.

All available signals converge on this being a genuine but bounded availability risk rather than a top-tier emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes remote, low-complexity, unauthenticated exploitation with pure availability impact - no confidentiality or integrity loss - which is fully consistent with the CWE-770 (unbounded resource allocation) description of unbounded detached threads exhausting memory and file descriptors. CISA SSVC reinforces this: Exploitation 'none' (no observed activity), Automatable 'yes' (the connection-flooding attack is trivially scriptable), and Technical Impact 'partial' (service degradation, not full system compromise). There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the 7.5 reflects ease and impact of a DoS, not evidence of real-world attacks. The SSVC 'Automatable: yes' combined with unauthenticated network reach means the barrier to weaponization is low if an attacker chooses to, but the ceiling is limited to denial of service against the management console. Net: a real patching priority for internet- or LAN-exposed cockpit-tls, but not a critical RCE-class emergency.

An unauthenticated attacker with network access to the cockpit-tls port (typically 9090) opens and holds open a large number of simultaneous TLS connections, each of which causes cockpit-tls to spawn a detached thread that is never bounded or reaped. Sustained connection floods exhaust memory and file descriptors until the Cockpit web console becomes unresponsive or crashes for legitimate administrators. No public exploit code is identified, but the attack is trivially scriptable given the low complexity and lack of authentication.