RHSA-2026:97514: Important: subscription-manager-cockpit security update
Subscription Manager Cockpit UISecurity Fix(es): lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/subscription-manager-cockpitto a version that resolves this vulnerability.Fixed in 17-1.el9 - Upgrade
Upgrade
redhat/rhsm-iconsto a version that resolves this vulnerability.Fixed in 17-1.el9
Event History
Frequently Asked Questions
Can I determine the affected or fixed package versions from this advisory record?
No. The record identifies subscription-manager-cockpit and rhsm-icons but does not list affected, fixed, or installed package versions.
Does the advisory provide a workaround for systems that cannot be updated immediately?
No temporary mitigation or configuration workaround is described in the provided advisory information.