RLSA-2026:97090: Important: subscription-manager-cockpit security update
Subscription Manager Cockpit UI
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/rhsm-iconsto a version that resolves this vulnerability.Fixed in 0:17-1.el10.rocky.0.1 - Upgrade
Upgrade
rocky-linux/subscription-manager-cockpitto a version that resolves this vulnerability.Fixed in 0:17-1.el10.rocky.0.1
Event History
Frequently Asked Questions
Which components should be prioritized for remediation?
Prioritize systems with the rocky-linux/subscription-manager-cockpit or rocky-linux/rhsm-icons packages installed. The update addresses two lodash vulnerabilities affecting the Subscription Manager Cockpit UI.
What exploitation conditions are indicated by the advisory's severity vector?
The supplied CVSS vector indicates network-based exploitation with no required privileges or user interaction, but with high attack complexity. Successful exploitation could affect confidentiality, integrity, and availability.
How can I determine whether a system is affected?
Check whether rocky-linux/subscription-manager-cockpit or rocky-linux/rhsm-icons is installed on the system, then compare the installed package state with the security update identified as RLSA-2026:97090. The advisory does not provide fixed package version numbers.