RLSA-2026:97539: Important: cockpit-machines security update

Q: What does the supplied CVSS information indicate about exploitation prerequisites?

The CVSS vector indicates network-reachable exploitation with high attack complexity, requiring no privileges and no user interaction. It also indicates high potential impact to confidentiality, integrity, and availability.

Q: Does the advisory provide the fixed package version or a way to identify affected installed versions?

No. The provided advisory data names rocky-linux/cockpit-machines but does not include affected or fixed version numbers, package build identifiers, or detection steps.

Published Nov 13, 2026

Updated

Cockpit component for managing libvirt virtual machines.

Security Fix(es):

lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Affected Software

1 affected componentFixes available

rocky-linux/cockpit-machines<0:355-1.el9

0:355-1.el9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/cockpit-machines to a version that resolves this vulnerability.
Fixed in 0:355-1.el9

Event History

Nov 13, 2026

Advisory Published

via OSV·06:05 AM

Data Sourced

via OSV·06:05 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What does the supplied CVSS information indicate about exploitation prerequisites?

The CVSS vector indicates network-reachable exploitation with high attack complexity, requiring no privileges and no user interaction. It also indicates high potential impact to confidentiality, integrity, and availability.

Does the advisory provide the fixed package version or a way to identify affected installed versions?

No. The provided advisory data names rocky-linux/cockpit-machines but does not include affected or fixed version numbers, package build identifiers, or detection steps.

RLSA-2026:97539: Important: cockpit-machines security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does the supplied CVSS information indicate about exploitation prerequisites?

Does the advisory provide the fixed package version or a way to identify affected installed versions?

Company

Resources

Contact

Frequently Asked Questions

What does the supplied CVSS information indicate about exploitation prerequisites?

Does the advisory provide the fixed package version or a way to identify affected installed versions?