RLSA-2026:97238: Important: cockpit-machines security, bug fix, and enhancement update
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950)
Bug Fix(es) and Enhancement(s):
CentOS 10 host: Can't create Cockpit virtual machine in Firefox, can create it in Chrome (JIRA:Rocky Linux-146122)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-machinesto a version that resolves this vulnerability.Fixed in 0:355-1.el10
Event History
Frequently Asked Questions
Which component should be prioritized for remediation?
Prioritize systems running the Rocky Linux cockpit-machines component, which is used to manage libvirt virtual machines. The update addresses two lodash vulnerabilities with high-severity impacts to confidentiality, integrity, and availability.
Does exploiting these issues require an authenticated user or user interaction?
The provided CVSS vector indicates network-based exploitation with no privileges required and no user interaction required. It also indicates high attack complexity.
What is the potential impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impacts as high. The listed issues include arbitrary code execution through untrusted input in lodash template imports and prototype pollution that can delete built-in prototype properties.