RHSA-2026:98562: Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines.Security Fix(es): cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpit-machinesto a version that resolves this vulnerability.Fixed in 355.1-1.el10_3
Event History
Frequently Asked Questions
What types of secrets could be exposed if this issue is present?
The listed issues involve guest credentials, Red Hat Subscription Management offline tokens, and other sensitive data being passed through command-line or JSON arguments that may be visible in process lists.