RHSA-2026:97539: Important: cockpit-machines security update

Q: What risk level is assigned to this advisory?

The advisory is assigned a risk level of 60 and is classified as Important.

Q: When was this advisory published?

It was published on 2026-11-10 and was last modified on the same date.

Published Nov 10, 2026

Updated

Cockpit component for managing libvirt virtual machines.Security Fix(es): lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Affected Software

2 affected componentsFixes available

redhat/cockpit-machines<355-1.el9

355-1.el9

redhat/cockpit-machines<355-1.el9

355-1.el9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/cockpit-machines to a version that resolves this vulnerability.
Fixed in 355-1.el9

Event History

Nov 10, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What risk level is assigned to this advisory?

The advisory is assigned a risk level of 60 and is classified as Important.

When was this advisory published?