CVE-2026-92768
Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
- State
- Published
- Severity
- 5.5 Medium
- Published
- Sep 18, 2026
- Updated
- Oct 21, 2026
- Reserved
- Sep 16, 2026
Description
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-214 Invocation of Process Using Visible Sensitive Information
Affected Products
| Product | Versions |
|---|---|
Red Hat Enterprise Linux 10Red Hat |
|
Red Hat Enterprise Linux 9Red Hat |
|
References
- RHSA-2026:86970vendor-advisory
- RHSA-2026:86971vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-92768vdb-entry
- RHBZ#2469258issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.