RLSA-2026:99602: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151)
cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpitto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-wsto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-ws-selinuxto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-docto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-packagekitto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-storagedto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/cockpit-systemto a version that resolves this vulnerability.Fixed in 0:366.1.1-1.el9_9.rocky.0.1
Event History
Frequently Asked Questions
Which Cockpit components are covered by this update?
The advisory covers cockpit, cockpit-ws, cockpit-bridge, cockpit-ws-selinux, cockpit-packagekit, cockpit-doc, cockpit-debuginfo, and cockpit-debugsource packages from Rocky Linux.
What attack paths are addressed?
The update addresses a local privilege-escalation issue involving insecure symlink handling when adding public keys, and a denial-of-service issue caused by unbounded fragmented WebSocket messages. The supplied CVSS vector indicates no privileges or user interaction are required, but the advisory does not specify those conditions separately for each CVE.