{"api_version":"1","generated_at":"2026-11-10T16:43:34+00:00","cve":"CVE-2026-125672","urls":{"html":"https://cve.report/CVE-2026-125672","api":"https://cve.report/api/cve/CVE-2026-125672.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-125672","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-125672"},"summary":{"title":"Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option","description":"A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-11-10 11:16:43","updated_at":"2026-11-10 11:16:43"},"problem_types":["CWE-88","CWE-88 Improper Neutralization of Argument Delimiters in a Command"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Primary","score":"6.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569357","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2569357","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-125672","name":"https://access.redhat.com/security/cve/CVE-2026-125672","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-125672","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125672","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-21T04:10:42.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-11-10T09:18:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"There is no complete mitigation available without a code fix. As a partial mitigation, administrators can restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and should carefully verify the Keyserver address shown in the \"Edit Tang keyserver\" dialog before clicking Save -- a value that does not resemble a well-formed hostname (for example, one starting with a hyphen) should not be accepted.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Andrey Vasilevsky for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"cockpit","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unknown","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"credits":[{"lang":"en","value":"Red Hat would like to thank Andrey Vasilevsky for reporting this issue."}],"datePublic":"2026-11-10T09:18:00.000Z","descriptions":[{"lang":"en","value":"A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-88","description":"Improper Neutralization of Argument Delimiters in a Command","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T10:43:39.678Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-125672"},{"name":"RHBZ#2569357","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569357"}],"timeline":[{"lang":"en","time":"2026-10-21T04:10:42.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-11-10T09:18:00.000Z","value":"Made public."}],"title":"Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option","workarounds":[{"lang":"en","value":"There is no complete mitigation available without a code fix. As a partial mitigation, administrators can restrict local interactive console or desktop login access on hosts running Cockpit's Storage module to trusted users only, and should carefully verify the Keyserver address shown in the \"Edit Tang keyserver\" dialog before clicking Save -- a value that does not resemble a well-formed hostname (for example, one starting with a hyphen) should not be accepted."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-88: Improper Neutralization of Argument Delimiters in a Command"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-125672","datePublished":"2026-11-10T10:43:39.678Z","dateReserved":"2026-11-10T09:32:23.544Z","dateUpdated":"2026-11-10T10:43:39.678Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 11:16:43","lastModifiedDate":"2026-11-10 11:16:43","problem_types":["CWE-88","CWE-88 Improper Neutralization of Argument Delimiters in a Command"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"125672","Ordinal":"1","Title":"Cockpit: cockpit-storaged: tang keyserver address from an untrus","CVE":"CVE-2026-125672","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"125672","Ordinal":"1","NoteData":"A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a \"--\" separator. An address beginning with \"-\" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.","Type":"Description","Title":"Cockpit: cockpit-storaged: tang keyserver address from an untrus"}]}}}