CVE-2026-113496: Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
A flaw was found in cockpit-machines. Saving VNC console settings passes the configured password through virtXmlEdit() and runVirtXml() into a virt-xml --graphics command-line argument. A local unprivileged attacker on a host permitting cross-user process inspection can read the password while another user saves the settings. Because the dialog also submits an existing password when other settings are changed, changing only the console port can expose the credential again. A disclosed password may allow unauthorized access to a guest's VNC console when the console is active, reachable, and accepts that password. Loopback-only listening does not by itself prevent access by a local attacker.
Other sources
A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this disclosure?
Hosts running cockpit-machines are exposed when they allow unprivileged users to inspect processes owned by other users. Exposure occurs while another user saves or modifies VNC console settings.
What does an attacker need to exploit the issue?
An attacker needs local unprivileged access to the host and the ability to inspect cross-user process information. They must observe the process list while VNC console settings are being modified.
What could an attacker obtain from the exposed command line?
The attacker could read the configured VNC console password. That password may allow unauthorized access to the affected guest virtual machine's graphical console.