CVE catalog

CVE-2026-113495

cockpit-machines: CVE-2026-113495

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancockpit-machinessid359-1vulnerable
Debiancockpit-machinesforky359-1vulnerable
Debiancockpit-machinestrixie332-1vulnerable
Debiancockpit-machinesbookworm288-1vulnerable
Ubuntucockpit-machines22.04251-1vulnerable
Ubuntucockpit-machines22.04254-1vulnerable
Ubuntucockpit-machines22.04255-1vulnerable
Ubuntucockpit-machines22.04256-1vulnerable
Ubuntucockpit-machines22.04258-1vulnerable
Ubuntucockpit-machines22.04259-1vulnerable
Ubuntucockpit-machines22.04260-1vulnerable
Ubuntucockpit-machines22.04261-1vulnerable
Ubuntucockpit-machines22.04262-1vulnerable
Ubuntucockpit-machines22.04263-1vulnerable
Ubuntucockpit-machines22.04264-1vulnerable
Ubuntucockpit-machines22.04265-1vulnerable
Ubuntucockpit-machines24.04299-1vulnerable
Ubuntucockpit-machines24.04300-1vulnerable
Ubuntucockpit-machines24.04301-1vulnerable
Ubuntucockpit-machines24.04302-1vulnerable
Ubuntucockpit-machines24.04303-1vulnerable
Ubuntucockpit-machines24.04304-1vulnerable
Ubuntucockpit-machines24.04305-1vulnerable
Ubuntucockpit-machines24.04306-1vulnerable
Ubuntucockpit-machines24.04307-1vulnerable
Ubuntucockpit-machines24.04310-1vulnerable
Ubuntucockpit-machines26.10351-1vulnerable
Ubuntucockpit-machines26.10353-3vulnerable
Ubuntucockpit-machines26.10355-1vulnerable
Ubuntucockpit-machines26.10355-1ubuntu1vulnerable
Ubuntucockpit-machines26.10356-1vulnerable
Ubuntucockpit-machines26.04339-1vulnerable
Ubuntucockpit-machines26.04341-1vulnerable
Ubuntucockpit-machines26.04343-1vulnerable
Ubuntucockpit-machines26.04345-1vulnerable
Ubuntucockpit-machines26.04346-1vulnerable
Ubuntucockpit-machines26.04347-1vulnerable
Ubuntucockpit-machines26.04348-1vulnerable
Ubuntucockpit-machines26.04351-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancockpit-machinessourcesid(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourceforky(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] cockpit-machines: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cockpit-machines]Affected
    Details (4)

    • 288-1 · all · bookworm

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 288-1 · all · bookworm

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 332-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 332-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

[Debian 13 (Trixie)]

  • [cockpit-machines]Affected
    Details (4)

    • 332-1 · all · trixie

      Affected

      dsa · cockpit-machines · debian · 13

    • 332-1 · all · trixie

      Affected

      dsa · cockpit-machines · debian · 13

    • 355-1~bpo13+1 · all · trixie-backports

      Affected

      dsa · cockpit-machines · debian · 13

    • 355-1~bpo13+1 · all · trixie-backports

      Affected

      dsa · cockpit-machines · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]