RHSA-2026:99601: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.Security Fix(es): cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151) cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-docto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-packagekitto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-storagedto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-systemto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8 - Upgrade
Upgrade
redhat/cockpitto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-wsto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8.aa - Upgrade
Upgrade
redhat/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 356.4.1-1.el9_8.aa
Event History
Frequently Asked Questions
Which Cockpit package variants are covered by this update?
The update covers cockpit, cockpit-ws, cockpit-bridge, cockpit-ws-selinux, cockpit-packagekit, cockpit-doc, cockpit-debuginfo, and cockpit-debugsource.