REDHAT-BUG-2451155: High severity Cockpit project Cockpit vulnerability
vulnerability in Cockpit’s system logs UI code (pkg/systemd/logsJournal.jsx, loadServiceFilters() path). The flaw is caused by building a command from an array, joining it into a single string with only space escaping, and then executing it via /bin/bash -ec. User-controlled parameters from the logs page (e.g., #/system/logs#/?since=...) reach this code path unsanitized and can include shell metacharacters such as command substitution ($(...)). A crafted link can therefore inject arbitrary shell commands into the constructed pipeline (set -o pipefail; ... | grep ... | sort -u) and execute them on the host. The provided PoC demonstrates writing the output of id into /tmp/cockpit-rce-proof, confirming code execution in the target environment.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running Cockpit with the system logs UI and the affected loadServiceFilters() path are exposed when user-controlled logs-page parameters reach that code. The issue executes injected commands on the host running Cockpit.
What does an attacker need to trigger command execution?
The attacker needs to supply crafted user-controlled parameters to the Cockpit logs page, such as a since parameter in a logs-page URL. Shell metacharacters, including command substitution syntax, can be used to inject commands into the shell-executed pipeline; the available data does not state whether authentication is required.
How can the provided proof of concept be recognized on a host?
The provided PoC writes the output of id to /tmp/cockpit-rce-proof. That file is an indicator of this specific PoC, not proof that no other exploitation occurred if it is absent.
Which vendor advisories are referenced for remediation?
The referenced Red Hat advisories are RHSA-2026:21390, RHSA-2026:21395, and RHSA-2026:21394.