A flaw was found in cockpit-machines. Saving VNC console settings passes the configured password through virtXmlEdit() and runVirtXml() into a virt-xml --graphics command-line argument. A local unprivileged attacker on a host permitting cross-user process inspection can read the password while another user saves the settings. Because the dialog also submits an existing password when other settings are changed, changing only the console port can expose the credential again. A disclosed password may allow unauthorized access to a guest's VNC console when the console is active, reachable, and accepts that password. Loopback-only listening does not by itself prevent access by a local attacker.

A flaw was found in cockpit-machines. Saving VNC console settings passes the configured password through virtXmlEdit() and runVirtXml() into a virt-xml --graphics command-line argument. A local unprivileged attacker on a host permitting cross-user process inspection can read the password while another user saves the settings. Because the dialog also submits an existing password when other settings are changed, changing only the console port can expose the credential again. A disclosed password may allow unauthorized access to a guest's VNC console when the console is active, reachable, and accepts that password. Loopback-only listening does not by itself prevent access by a local attacker.