CVE-2026-4631

Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

State: Published
Severity: 9.8 Critical
Published: Apr 7, 2026
Updated: Oct 15, 2026
Reserved: Mar 23, 2026

Description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:344-3.el10_1 and laterNot affected
Red Hat Enterprise Linux 10Red Hat	0:356.1-1.el10_2 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:334.1-3.el10_0 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:356.1-1.el9_8 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:344-2.el9_7 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:356.1-1.el9_8 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:344-2.el9_7 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:334.2-2.el9_6 and laterNot affected
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat

References

RHBA-2026:21387vendor-advisory
RHBA-2026:21388vendor-advisory
RHSA-2026:7381vendor-advisory
RHSA-2026:7382vendor-advisory
RHSA-2026:7383vendor-advisory
RHSA-2026:7384vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-4631vdb-entry
RHBZ#2450246issue-tracking
https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427
http://www.openwall.com/lists/oss-security/2026/04/10/5
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4631.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.