CVE-2026-125672: Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
Other sources
A flaw was found in cockpit. The cockpit-storaged module's gettangadv() function (pkg/storaged/crypto/tang.jsx) builds curl's argument vector by string concatenation: cockpit.spawn(["curl", "-sSf", url + "/adv"]), with no "--" separator between options and the positional argument. On the Edit-Tang-keyserver path, this url value is read verbatim from a clevis token embedded in the LUKS header of a block device, which is data controlled by whoever can write to or attach that device, not necessarily the Cockpit operator. validateurl() only rejects empty strings and values that fail JavaScript URL parsing; a value such as "-K/var/tmp/stash" parses successfully (hostname "-k") and is accepted. When such a value reaches curl, curl interprets it as the "-K" (config file) option instead of a hostname, loading an attacker-planted curl configuration file. The planted configuration can set "output" to any path the Cockpit session user can write, "url" to a file:// URL to read any file that user can read, or "upload-file" with a remote destination to exfiltrate data -- all running as the Cockpit session user (not root; the LUKS-header read itself runs with superuser privileges via python.spawn(..., {superuser: "require"}), but the subsequent curl invocation does not). A local unprivileged user with a local, active console or desktop login session (not a remote SSH or Cockpit web session) can plant the malicious LUKS header using the standard, default-granted udisks2 org.freedesktop.udisks2.loop-setup polkit permission (allowactive=yes), requiring no elevated privilege. An administrator with Cockpit access who then opens the "Edit Tang keyserver" dialog for that device and clicks Save, without recognizing the prefilled value as a curl option rather than an address, triggers the chain. No non-default configuration is required.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when an attacker can attach a crafted LUKS block device containing a malicious clevis token and an administratively privileged user edits that device's Tang keyserver settings through Cockpit. The description specifically identifies local unprivileged users with an active console or desktop login session as an example of an attacker able to provide such a device.
What interaction is required for exploitation?
The attacker must cause a privileged Cockpit user to edit the affected device's Tang keyserver settings. Exploitation relies on the user unknowingly triggering curl option injection from a Tang address that begins with a hyphen.
What is the potential impact?
Successful exploitation can allow arbitrary file reads or writes with the privileges of the Cockpit session user. Availability impact is not indicated in the supplied severity vector.