EUVD-2026-83296
GHSA-2wj2-6xq8-f5rx
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Local unprivileged attacker (AV:L/PR:L) must win a timing race (AC:H) while an admin performs the operation (UI:R); arbitrary chown/chmod yields high integrity and availability impact, no direct confidentiality loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.
AnalysisAI
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires: (1) local shell/account access to the affected RHEL 9 or RHEL 10 host (AV:L, PR:L); (2) the Cockpit web console with the cockpit-files component installed and in use; (3) an administrator actively performing a privileged file operation (changing ownership or permissions) through cockpit-files while the attacker manipulates directory entries - this is the UI:R user-interaction requirement; and (4) winning the narrow timing window of the symlink race (AC:H), which is non-deterministic and may require many attempts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity local privilege/integrity issue, not an urgent internet-facing threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, so remediation currently depends on mitigation and on monitoring the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-91203 (and the associated Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2465632) for a fixed cockpit-files package version and update via dnf as soon as one is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-363 – Race Condition Enabling Link Following
View allShare
External POC / Exploit Code
Leaving vuln.today