Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
Summary
| CVE | CVE-2026-92747 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-18 18:18:16 UTC |
| Updated | 2026-10-21 14:17:22 UTC |
| Description | A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies. |
Risk And Classification
Primary CVSS: v3.1 5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.001520000 probability, percentile 0.039670000 (date 2026-10-21)
Problem Types: CWE-214 | CWE-214 Invocation of Process Using Visible Sensitive Information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:348.1-1.el10_2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:348.1-1.el9_8 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-92747 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:86970 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:86971 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Found by AISLE in partnership with Red Hat. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-11T19:59:32.000Z | Reported to Red Hat. |
| CNA | 2026-09-18T16:35:00.000Z | Made public. |
Workarounds
CNA: Exposure can be reduced by avoiding VM creation or installation flows that supply rootPassword or userPassword while untrusted local users are active on the host, and by using an alternative provisioning method where one is available. Restricting cross-user process inspection on the host, for example by hardening /proc visibility with the hidepid mount option, also limits the ability of other local users to read the install_machine.py command line. These measures reduce the exposure window but do not remove the underlying issue of credentials being passed in process arguments; they should be treated as temporary risk reduction until a fixed cockpit-machines package is available.