RLSA-2026:98562: Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-machinesto a version that resolves this vulnerability.Fixed in 0:355.1-1.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What level of access is required to exploit these issues?
An attacker needs local access with low privileges. No user interaction is required.
What is the expected security impact?
The issues have a high confidentiality impact, with no stated integrity or availability impact. The impact remains within the affected system's security authority.