ALSA-2026:94485: Moderate: cockpit security, bug fix, and enhancement update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147) cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in sendloginhtml (CVE-2026-76235)
Bug Fix(es) and Enhancement(s):
[cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/cockpitto a version that resolves this vulnerability.Fixed in 310.10-1.el8_10 - Upgrade
Upgrade
almalinux/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 310.10-1.el8_10 - Upgrade
Upgrade
almalinux/cockpit-docto a version that resolves this vulnerability.Fixed in 310.10-1.el8_10 - Upgrade
Upgrade
almalinux/cockpit-systemto a version that resolves this vulnerability.Fixed in 310.10-1.el8_10 - Upgrade
Upgrade
almalinux/cockpit-wsto a version that resolves this vulnerability.Fixed in 310.10-1.el8_10
Event History
Frequently Asked Questions
Which Cockpit components are affected by these security fixes?
The advisory identifies a denial-of-service issue in cockpit-ws related to URL roots without a trailing slash, and an unauthenticated remote memory leak in cockpit-ws involving the CockpitLang cookie during login-page handling.
Does exploiting either issue require authentication?
The memory leak is explicitly described as unauthenticated and remotely exploitable. The advisory does not state whether authentication is required for the denial-of-service issue.
What temporary mitigation is documented if updates cannot be applied immediately?
The advisory does not provide a workaround or temporary mitigation.