RLSA-2026:97514: Important: subscription-manager-cockpit security update
Subscription Manager Cockpit UI
Security Fix(es):
lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/rhsm-iconsto a version that resolves this vulnerability.Fixed in 0:17-1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/subscription-manager-cockpitto a version that resolves this vulnerability.Fixed in 0:17-1.el9.rocky.0.1
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
The CVSS vector indicates no privileges are required and no user interaction is required. It also identifies the attack vector as network-based.
How difficult is exploitation expected to be?
The CVSS vector rates attack complexity as high. This means an attacker must satisfy additional conditions beyond simply reaching the affected service or interface.
Which installations should be reviewed for exposure?
Review Rocky Linux systems with rhsm-icons or subscription-manager-cockpit installed. The advisory does not provide affected or fixed package versions, so installed package status should be checked against the referenced erratum.