https://seclists.org/oss-sec/2026/q2/88: CVE-2026-4631 [cockpit] Unauthenticated mote code execution due to SSH command-line argument injection
Affected Software
Frequently Asked Questions
Does an attacker need valid Cockpit or SSH credentials to exploit this?
No. An attacker only needs access to the Cockpit webservice and can provide an arbitrary Authorization: Basic header, including invalid credentials, to trigger the SSH invocation.
Which deployments are most exposed?
Deployments where the Cockpit webservice is reachable by an attacker should be prioritized, because Cockpit supports connecting to remote machines through SSH by default. The affected execution path is described for Cockpit versions since 326/327, which invoke python3 -m cockpit.beiboot and then the OpenSSH ssh client.
When does injected code run relative to SSH authentication?
Injected commands execute before SSH authentication completes or fails. A successful SSH login is therefore not required for command execution.
What request can be used to trigger the vulnerable path?
The described trigger is a request to /cockpit+=<hostname>/login with an Authorization: Basic header. This reaches the remote SSH connection flow during authentication.