RHSA-2026:97537: Important: cockpit-podman security update
The Cockpit user interface for Podman containers.Security Fix(es): lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpit-podmanto a version that resolves this vulnerability.Fixed in 129-1.el9
Event History
Frequently Asked Questions
Which component should be prioritized for remediation?
Prioritize systems using the Cockpit user interface for Podman containers, as the advisory applies to the redhat/cockpit-podman software package.
What security issues are addressed by this update?
The update addresses arbitrary code execution through untrusted input in lodash template imports (CVE-2026-4800) and prototype pollution that can delete built-in prototype properties through an array path bypass (CVE-2026-2950).
How severe is this advisory?
Red Hat classifies this as an Important security update. The supplied data does not provide CVSS scores or affected package versions.