RLSA-2026:99603: Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151)
cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpitto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-bridgeto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-debuginfoto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-debugsourceto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-wsto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-docto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10 - Upgrade
Upgrade
rocky-linux/cockpit-systemto a version that resolves this vulnerability.Fixed in 0:310.10.2-1.el8_10
Event History
Frequently Asked Questions
Which Cockpit components are covered by this update?
The advisory covers rocky-linux/cockpit, cockpit-bridge, cockpit-ws, cockpit-system, cockpit-doc, cockpit-debuginfo, and cockpit-debugsource.
What types of impact do the addressed flaws have?
One issue allows local privilege escalation through insecure symlink handling in the public-key addition helper. The other can cause denial of service through unbounded fragmented WebSocket messages.
Can the denial-of-service issue be exploited remotely without authentication?
The supplied severity vector for the advisory is AV:N/AC:L/PR:N/UI:N, indicating network reachability, low complexity, no required privileges, and no user interaction. The advisory rates the overall update high severity with a 7.5 score.