CVE-2026-113495: Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.
Other sources
A flaw was found in cockpit-machines. The getRhelImageUrl() and downloadRhelImage() functions pass a Red Hat Subscription Management (RHSM) access token to Python helpers in JSON command-line arguments. When another user initiates an RHSM-backed image retrieval workflow, a local unprivileged attacker on a host permitting cross-user process inspection can read the token from the helper's command line. For system connections, the download helper requires elevated execution, and the token remains in its arguments while an image transfer is running. Disclosure of the bearer token may allow unauthorized access to RHSM resources within the token's permissions and validity period.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Red Hat cockpit-machines are exposed when they perform image retrieval operations using RHSM authentication tokens and allow cross-user process inspection. A local unprivileged user must be able to view another user's active process command-line arguments.
What must an attacker do to exploit it?
The attacker needs local access with unprivileged account permissions, the ability to inspect processes owned by another user, and must observe the helper process while it is active during image retrieval. The disclosed token may permit access to RHSM resources for the remainder of its validity period.
What can be done if patching cannot happen immediately?
Restrict cross-user process inspection so unprivileged local users cannot read command-line arguments of helper processes. Limit untrusted local access and avoid or closely control RHSM-backed image retrieval operations until remediation is available.
How can administrators determine whether they may be affected?
Confirm whether Red Hat cockpit-machines is installed and used for image retrieval with RHSM authentication. Also review whether local unprivileged users can inspect command-line arguments for processes owned by other users.