CVE-2026-4631

9.8Critical

Published 07 Apr 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Unauthenticated attackers can execute arbitrary shell commands on the Cockpit host. They only need network access to the Cockpit web service login endpoint.

Root cause

The remote login feature passes unsanitized user-supplied hostnames and usernames directly into the underlying SSH client call before authentication occurs.

Affected systems

Cockpit (versions not listed — check the vendor advisory).

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the Cockpit package to the patched version provided in vendor errata. If patching must wait, immediately stop and disable cockpit.socket or restrict access to port 9090 at the firewall.

shell

$ sudo systemctl stop cockpit.socket cockpit.service && sudo systemctl disable cockpit.socket

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-4631