UBUNTU-CVE-2026-91151: Medium severity ubuntu/cockpit vulnerability
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorizedkeys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local authenticated user must be able to control the target account's home directory. The issue is relevant where the ssh-add-public-key.sh helper is run with elevated privileges against such an account.
What access or conditions are required for exploitation?
The attacker needs local authenticated access, control over symlinks in the target account's .ssh or authorized_keys paths, and an opportunity for the helper to run with elevated privileges. The provided information does not establish that a default configuration is affected.
What could indicate that a system has been targeted?
Potential indicators include unexpected ownership or permission changes to files reachable through a target account's .ssh or authorized_keys paths. Review executions of the privileged helper and inspect those paths for attacker-controlled symbolic links.