EUVD-2026-29051
GHSA-3wjm-5g86-c6p3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid Cockpit credentials
-
DeliveryCraft malicious URL with shell metacharacters in logs UI parameters
-
ExploitDeliver link via phishing to authenticated admin
-
ExecutionUser clicks link while logged into Cockpit
-
PersistUnsanitized parameters execute injected commands
-
ImpactEstablish root-level persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the Cockpit web interface (PR:L) - attacker must possess valid credentials for a user account with Cockpit login privileges on the target RHEL system. Additionally requires user interaction (UI:R) - a legitimate authenticated administrator must be induced to click or navigate to a specially crafted URL targeting the system logs UI component. The vulnerable logsJournal.jsx component must be accessible and functional (default in standard Cockpit installations). Exploitation is limited by network accessibility (AV:N indicates remote exploitation is possible if Cockpit interface is exposed beyond localhost, commonly via TCP port 9090), but organizations restricting Cockpit to internal management networks significantly reduce attack surface. No special non-default configuration is required; standard Cockpit deployments on RHEL 7/8/9/10 with the logs UI enabled are vulnerable. |
| Impact | CVSS 8.0 (High) reflects the severe post-exploitation impact (complete system compromise with high confidentiality, integrity, and availability impact), but real-world exploitability is constrained by authentication and user interaction requirements. The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates network-accessible attack surface with low technical complexity, but requires both authenticated access (PR:L) and user interaction (UI:R) - meaning an attacker must either compromise valid Cockpit credentials or socially engineer an authenticated administrator into clicking a malicious link. The attack is not automatable at scale due to the UI:R requirement, reducing mass exploitation risk. No CISA KEV listing and no public POC identified suggest this is not yet actively exploited, though the GitHub reference to the vulnerable code increases reverse-engineering risk. The scope is unchanged (S:U), limiting impact to the Cockpit instance's privilege context. Priority should be moderate-to-high for organizations running Cockpit on internet-facing or multi-tenant RHEL systems where phishing or credential compromise is plausible, but lower for isolated administrative networks with strong access controls. Key missing data: EPSS score unavailable, no vendor patch version specified in provided data, exploitation status unconfirmed beyond theoretical demonstration. |
| Exploit ScenarioDerived | An authenticated attacker with valid Cockpit credentials crafts a malicious URL containing shell command substitutions in log filtering parameters, such as injecting |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 11, 2026
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
RemediationAI
Check Red Hat Customer Portal at https://access.redhat.com/security/cve/CVE-2026-4802 and Bugzilla 2451155 for updated Cockpit packages addressing this command injection flaw; apply vendor-provided patches via standard yum/dnf update procedures once released. Until patches are available, implement compensating controls: restrict Cockpit web interface access to trusted administrative networks only via firewall rules (block external access to default TCP port 9090), enforce multi-factor authentication for all Cockpit users to raise attacker credential acquisition bar, deploy web application firewall rules to detect and block URLs containing shell metacharacters in query parameters targeting /system/logs paths, and educate administrators to avoid clicking untrusted links while authenticated to Cockpit sessions. Note that disabling the system logs UI feature entirely eliminates attack surface but removes legitimate log viewing functionality. Review GitHub commit history at https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx for upstream fixes that may be backported to RHEL packages.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cockpit is a web-based server administration interface for Linux systems, providing real-time system monitoring and management capabilities. The vulnerability resides in the systemd logs journal viewer component (logsJournal.jsx), where user-controlled parameters embedded in crafted URLs are passed to shell commands without proper sanitization or validation. This constitutes a CWE-78 OS Command Injection flaw, where shell metacharacters (such as backticks, semicolons, or $() substitutions) in URL parameters are interpreted by the underlying shell rather than treated as literal data. The affected CPE strings indicate this impacts Cockpit deployments across Red Hat Enterprise Linux versions 7, 8, 9, and 10, suggesting a cross-version architectural issue in how the logs UI handles parameter parsing and command construction.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
Executive ViewAI
CVE-2026-4802 affects Cockpit's system logs interface across RHEL 7-10, allowing authenticated users to execute arbitrary commands through malicious URL parameters. Organizations relying on Cockpit for system administration face risk of privilege escalation and full host compromise from internal or compromised user accounts. This is an authenticated attack requiring low complexity, limiting but not eliminating organizational risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Cockpit web interface network access to authorized administrative users and networks only; (2) Implement application-level input validation or WAF rules blocking shell metacharacters (|, ;, &, $, `, >, <) in URL parameters targeting /system/logs endpoints; (3) Monitor and log all Cockpit authentication events and flag unusual URL parameters; (4) Require multi-factor authentication for Cockpit access to raise attack complexity; (5) Consider disabling system logs UI in Cockpit settings if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Micro 5.3 | Fixed |
| SUSE Linux Enterprise Micro 5.4 | Fixed |
| SUSE Linux Enterprise Micro 5.5 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| SUSE Linux Micro 6.0 | Fixed |
| SUSE Linux Micro 6.1 | Fixed |
| SUSE Linux Micro 6.2 | Fixed |
Exploit-DB