CVE-2026-4802: Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
Other sources
vulnerability in Cockpit’s system logs UI code (pkg/systemd/logsJournal.jsx, loadServiceFilters() path). The flaw is caused by building a command from an array, joining it into a single string with only space escaping, and then executing it via /bin/bash -ec. User-controlled parameters from the logs page (e.g., #/system/logs#/?since=...) reach this code path unsanitized and can include shell metacharacters such as command substitution ($(...)). A crafted link can therefore inject arbitrary shell commands into the constructed pipeline (set -o pipefail; ... | grep ... | sort -u) and execute them on the host. The provided PoC demonstrates writing the output of id into /tmp/cockpit-rce-proof, confirming code execution in the target environment.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/cockpitto a version that resolves this vulnerability.Fixed in 337-1+deb13u2Fixed in 370-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4802?
CVE-2026-4802 is classified as a critical vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2026-4802?
To fix CVE-2026-4802, upgrade to the latest version of Cockpit that addresses this vulnerability.
Who is affected by CVE-2026-4802?
CVE-2026-4802 affects all versions of Cockpit that do not implement proper sanitization for user-controlled parameters in system logs.
Can CVE-2026-4802 be exploited remotely?
Yes, CVE-2026-4802 can be exploited remotely by an attacker through crafted links in the system logs.
What type of attack is enabled by CVE-2026-4802?
CVE-2026-4802 enables arbitrary command execution, allowing potential attackers to execute unauthorized commands on the host system.