CVE catalog

CVE-2026-113496

cockpit-machines: CVE-2026-113496

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancockpit-machinessid359-1vulnerable
Debiancockpit-machinesforky359-1vulnerable
Debiancockpit-machinestrixie332-1vulnerable
Debiancockpit-machinesbookworm288-1vulnerable
Ubuntucockpit-machines22.04251-1vulnerable
Ubuntucockpit-machines22.04254-1vulnerable
Ubuntucockpit-machines22.04255-1vulnerable
Ubuntucockpit-machines22.04256-1vulnerable
Ubuntucockpit-machines22.04258-1vulnerable
Ubuntucockpit-machines22.04259-1vulnerable
Ubuntucockpit-machines22.04260-1vulnerable
Ubuntucockpit-machines22.04261-1vulnerable
Ubuntucockpit-machines22.04262-1vulnerable
Ubuntucockpit-machines22.04263-1vulnerable
Ubuntucockpit-machines22.04264-1vulnerable
Ubuntucockpit-machines22.04265-1vulnerable
Ubuntucockpit-machines24.04299-1vulnerable
Ubuntucockpit-machines24.04300-1vulnerable
Ubuntucockpit-machines24.04301-1vulnerable
Ubuntucockpit-machines24.04302-1vulnerable
Ubuntucockpit-machines24.04303-1vulnerable
Ubuntucockpit-machines24.04304-1vulnerable
Ubuntucockpit-machines24.04305-1vulnerable
Ubuntucockpit-machines24.04306-1vulnerable
Ubuntucockpit-machines24.04307-1vulnerable
Ubuntucockpit-machines24.04310-1vulnerable
Ubuntucockpit-machines26.10351-1vulnerable
Ubuntucockpit-machines26.10353-3vulnerable
Ubuntucockpit-machines26.10355-1vulnerable
Ubuntucockpit-machines26.10355-1ubuntu1vulnerable
Ubuntucockpit-machines26.10356-1vulnerable
Ubuntucockpit-machines26.04339-1vulnerable
Ubuntucockpit-machines26.04341-1vulnerable
Ubuntucockpit-machines26.04343-1vulnerable
Ubuntucockpit-machines26.04345-1vulnerable
Ubuntucockpit-machines26.04346-1vulnerable
Ubuntucockpit-machines26.04347-1vulnerable
Ubuntucockpit-machines26.04348-1vulnerable
Ubuntucockpit-machines26.04351-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancockpit-machinessourcesid(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourceforky(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiancockpit-machinessourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] cockpit-machines: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cockpit-machines]Affected
    Details (4)

    • 288-1 · all · bookworm

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 288-1 · all · bookworm

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 332-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

    • 332-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · cockpit-machines · debian · bookworm; dsa · cockpit-machines · debian · 12

[Debian 13 (Trixie)]

  • [cockpit-machines]Affected
    Details (4)

    • 332-1 · all · trixie

      Affected

      dsa · cockpit-machines · debian · 13

    • 332-1 · all · trixie

      Affected

      dsa · cockpit-machines · debian · 13

    • 355-1~bpo13+1 · all · trixie-backports

      Affected

      dsa · cockpit-machines · debian · 13

    • 355-1~bpo13+1 · all · trixie-backports

      Affected

      dsa · cockpit-machines · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]