ALSA-2026:94533: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash (CVE-2026-91147) cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in sendloginhtml (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/cockpitto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-docto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-packagekitto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-storagedto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-systemto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-wsto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8 - Upgrade
Upgrade
almalinux/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 356.4-1.el9_8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Do all of the listed issues require an authenticated Cockpit user?
No. CVE-2026-76235 is explicitly described as an unauthenticated remote memory leak in cockpit-ws. The advisory does not specify authentication requirements for CVE-2026-91147 or CVE-2026-91149.