RLSA-2026:98459: Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-machinesto a version that resolves this vulnerability.Fixed in 0:355.1-1.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What access would an attacker need to exploit these issues?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What information could be exposed?
The listed fixes address exposure of sensitive data through process command-line arguments, including guest credentials provided as JSON arguments and RHSM offline tokens.
How can I determine whether a system may be affected?
Review systems running the Rocky Linux cockpit-machines package and check whether sensitive guest credentials or RHSM offline tokens may be passed through command-line or JSON process arguments. The advisory does not provide affected package versions or configuration-specific detection criteria.