RHSA-2026:86970MediumCVSS 5.5

Red Hat Security Advisory: cockpit-machines security update

Published
October 21, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (3)

CVE-2026-92745 →CVE-2026-92747 →CVE-2026-92768 →

📋 Description

CVE-2026-92745 — cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments CVE-2026-92747 — cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list CVE-2026-92768 — cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments

🎯 Affected products3

  • Red Hat Enterprise Linux AppStream (v. 9)
  • cockpit-machines-0:348.1-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • cockpit-machines-0:348.1-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: A workaround is available for this issue. Until a fixed package is installed, avoid validating RHSM offline tokens through the Cockpit Machines "Download an OS" / RHEL image download flow on multi-user hosts where untrusted local users can inspect process metadata. As a system-level mitigation, restrict /proc visibility so unprivileged users cannot read other users' process command lines, for example by remounting /proc with the hidepid=2 mount option; this blocks cross-user observation of the helper process arguments that contain the offline token while the validation flow is running. Fixed packages are being released for the affected streams, and updating to a fixed cockpit-machines package once available for your stream resolves the issue. Workaround: Exposure can be reduced by avoiding VM creation or installation flows that supply rootPassword or userPassword while untrusted local users are active on the host, and by using an alternative provisioning method where one is available. Restricting cross-user process inspection on the host, for example by hardening /proc visibility with the hidepid mount option, also limits the ability of other local users to read the install_machine.py command line. These measures reduce the exposure window but do not remove the underlying issue of credentials being passed in process arguments; they should be treated as temporary risk reduction until a fixed cockpit-machines package is available. Workaround: Restrict visibility of process command-line arguments to other local users by mounting /proc with the hidepid=2 option, for example by remounting /proc with 'mount -o remount,hidepid=2 /proc' or configuring 'proc /proc proc defaults,hidepid=2 0 0' in /etc/fstab. This prevents unprivileged local users from reading other users' process arguments. Additionally, on shared hosts where other local users can inspect process arguments, avoid supplying root or user passwords through the Cockpit Machines VM create and install flows, and prefer provisioning methods that do not pass passwords on the command line. Updated cockpit-machines packages that stop passing password material on the command line are being delivered for affected streams; installing the updated package once it is available for your stream resolves this issue.

🔗 References (6)