Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
Priority LOW 39CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01016 63rd percentileScored 2026-11-07
Fix Fixed Red Hat: 10 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | 356.2-1.el10_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | 334.2-1.el10_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 310.8-1.el8_10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | 264.3-1.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | 264.3-1.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | 264.3-1.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | 286.2-1.el8_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | 286.2-1.el8_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 356.2-1.el9_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 356.2-1.el9_8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 264.3-1.el9_0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | 286.3-1.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | 311.3-1.el9_4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | 334.3-1.el9_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 356.2-1.el10_2 Patch available CNA
- Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 334.2-1.el10_0 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 310.8-1.el8_10 Patch available CNA
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 264.3-1.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 264.3-1.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 264.3-1.el8_6 Patch available CNA
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 286.2-1.el8_8 Patch available CNA
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 286.2-1.el8_8 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 356.2-1.el9_8 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 356.2-1.el9_8 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 264.3-1.el9_0 Patch available CNA
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 286.3-1.el9_2 Patch available CNA
- Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 311.3-1.el9_4 Patch available CNA
- Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 334.3-1.el9_6 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/o:redhat:enterprise_linux:10.2 | 10.2 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux_eus:10.0 | 10.0 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:8::baseos | 8 | — | Red Hat |
| cpe:/o:redhat:rhel_aus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.6::baseos | 8.6 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/o:redhat:rhel_tus:8.8::baseos | 8.8 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::baseos | 9 | — | Red Hat |
- cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
- cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:8::baseos Versions 8 — ·Red Hat
- cpe:/o:redhat:rhel_aus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.6::baseos Versions 8.6 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/o:redhat:rhel_tus:8.8::baseos Versions 8.8 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.0::baseos | 9.0 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.2::baseos | 9.2 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.4::appstream | 9.4 | — | Red Hat |
| cpe:/o:redhat:rhel_eus:9.4::baseos | 9.4 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.6::appstream | 9.6 | — | Red Hat |
| cpe:/o:redhat:rhel_eus:9.6::baseos | 9.6 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.0::baseos Versions 9.0 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.2::baseos Versions 9.2 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
- cpe:/o:redhat:rhel_eus:9.4::baseos Versions 9.4 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
- cpe:/o:redhat:rhel_eus:9.6::baseos Versions 9.6 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
Remediation
Red Hat 10 advisories
- RHSA-2026:21392 Released 2026-05-28 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) cockpit-packagekit-334.3-1.el9_6, cockpit-storaged-334.3-1.el9_6
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) cockpit-334.3-1.el9_6, cockpit-bridge-334.3-1.el9_6, cockpit-doc-334.3-1.el9_6 +2
- RHSA-2026:21700 Released 2026-05-28 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux BaseOS (v. 8) cockpit-310.8-1.el8_10, cockpit-bridge-310.8-1.el8_10, cockpit-doc-310.8-1.el8_10 +2
- RHSA-2026:21676 Released 2026-05-28 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream (v. 10) cockpit-packagekit-356.2-1.el10_2, cockpit-storaged-356.2-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) cockpit-356.2-1.el10_2, cockpit-bridge-356.2-1.el10_2, cockpit-doc-356.2-1.el10_2 +3
Show 7 more Red Hat advisories
- RHSA-2026:21647 Released 2026-05-28 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) cockpit-packagekit-311.3-1.el9_4, cockpit-pcp-311.3-1.el9_4, cockpit-storaged-311.3-1.el9_4
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) cockpit-311.3-1.el9_4, cockpit-bridge-311.3-1.el9_4, cockpit-doc-311.3-1.el9_4 +2
- RHSA-2026:21516 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) cockpit-264.3-1.el8_6, cockpit-bridge-264.3-1.el8_6, cockpit-doc-264.3-1.el8_6 +2
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) cockpit-264.3-1.el8_6, cockpit-bridge-264.3-1.el8_6, cockpit-doc-264.3-1.el8_6 +2
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) cockpit-264.3-1.el8_6, cockpit-bridge-264.3-1.el8_6, cockpit-doc-264.3-1.el8_6 +2
- RHSA-2026:21515 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) cockpit-286.2-1.el8_8, cockpit-bridge-286.2-1.el8_8, cockpit-doc-286.2-1.el8_8 +2
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) cockpit-286.2-1.el8_8, cockpit-bridge-286.2-1.el8_8, cockpit-doc-286.2-1.el8_8 +2
- RHSA-2026:21468 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream (v. 9) cockpit-packagekit-356.2-1.el9_8, cockpit-storaged-356.2-1.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) cockpit-356.2-1.el9_8, cockpit-bridge-356.2-1.el9_8, cockpit-doc-356.2-1.el9_8 +3
- RHSA-2026:21394 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) cockpit-packagekit-286.3-1.el9_2, cockpit-pcp-286.3-1.el9_2, cockpit-storaged-286.3-1.el9_2
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) cockpit-286.3-1.el9_2, cockpit-bridge-286.3-1.el9_2, cockpit-doc-286.3-1.el9_2 +2
- RHSA-2026:21395 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) cockpit-packagekit-264.3-1.el9_0, cockpit-pcp-264.3-1.el9_0, cockpit-storaged-264.3-1.el9_0
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) cockpit-264.3-1.el9_0, cockpit-bridge-264.3-1.el9_0, cockpit-doc-264.3-1.el9_0 +2
- RHSA-2026:21390 Released 2026-05-27 · Red Hat rating Importantcockpit security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) cockpit-packagekit-334.2-1.el10_0, cockpit-storaged-334.2-1.el10_0
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) cockpit-334.2-1.el10_0, cockpit-bridge-334.2-1.el10_0, cockpit-doc-334.2-1.el10_0 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:21676 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:21468 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:21395 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:21394 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:21390 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:21647 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:21392 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:21676 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:21700 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:21468 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2026:21516 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2026:21516 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2026:21515 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2026:21395 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2026:21394 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:21390 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2026:21647 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.6) | Fixed | RHSA-2026:21392 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2026:21516 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2026:21515 |
Not affected: 1 product
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4802
- 2026-10-03 Alias added: GHSA-3wjm-5g86-c6p3
References
Advisory 10
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-4802 · CVE Program
- CVE-2026-4802 · NVD
- FIRST EPSS
- GHSA-3wjm-5g86-c6p3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-4802 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences