Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
Summary
| CVE | CVE-2026-92745 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-18 18:18:16 UTC |
| Updated | 2026-10-21 14:17:22 UTC |
| Description | A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens. |
Risk And Classification
Primary CVSS: v3.1 5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.001000000 probability, percentile 0.008030000 (date 2026-10-21)
Problem Types: CWE-214 | CWE-214 Invocation of Process Using Visible Sensitive Information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:348.1-1.el10_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:348.1-1.el9_8 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-92745 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:86970 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:86971 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Found by AISLE in partnership with Red Hat. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-11T20:27:44.000Z | Reported to Red Hat. |
| CNA | 2026-09-18T16:35:00.000Z | Made public. |
Workarounds
CNA: A workaround is available for this issue. Until a fixed package is installed, avoid validating RHSM offline tokens through the Cockpit Machines "Download an OS" / RHEL image download flow on multi-user hosts where untrusted local users can inspect process metadata. As a system-level mitigation, restrict /proc visibility so unprivileged users cannot read other users' process command lines, for example by remounting /proc with the hidepid=2 mount option; this blocks cross-user observation of the helper process arguments that contain the offline token while the validation flow is running. Fixed packages are being released for the affected streams, and updating to a fixed cockpit-machines package once available for your stream resolves the issue.