RLSA-2026:97193: Important: cockpit-podman security update
The Cockpit user interface for Podman containers.
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-podmanto a version that resolves this vulnerability.Fixed in 0:129-1.el10
Event History
Frequently Asked Questions
Which component is affected by this update?
The update applies to the Cockpit user interface for Podman containers on Rocky Linux. The listed fixes address two lodash vulnerabilities used by this component.
What vulnerabilities are addressed?
The update addresses CVE-2026-4800, arbitrary code execution through untrusted input in lodash template imports, and CVE-2026-2950, prototype pollution that can delete built-in prototype properties through an array-path bypass.
How severe is the advisory?
It is rated High with a CVSS score of 8.1. The supplied vector indicates network attackability, no privileges or user interaction required, high impact to confidentiality, integrity, and availability, and high attack complexity.