CVE catalog

CVE-2026-4631

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit

[CVE catalog]

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Apr 7, 2026, 3:52:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 15.48% · Oct 25, 2026

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	cockpit	sid	`370-1`	fixed
Debian	cockpit	forky	`370-1`	fixed
Debian	cockpit	trixie	`337-1+deb13u2`	fixed
Debian	cockpit	trixie-security	`337-1+deb13u2`	fixed
Debian	cockpit	bookworm	`287.1-0+deb12u3`	not affected
Debian	cockpit	bookworm-security	`287.1-0+deb12u2`	not affected
Cpe	cockpit	Not reported	Not reported	not affected
Opensuse	cockpit	leap 16.0	`354-160000.3.1`	fixed
Suse	cockpit	linux enterprise server 16.0	`354-160000.3.1`	fixed
Suse	cockpit	linux enterprise server for sap applications 16.0	`354-160000.3.1`	fixed
Suse	cockpit	linux micro 6.2	`354-160000.3.1`	fixed
Opensuse	cockpit	tumbleweed	`360-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	cockpit	source	sid	`360-1`	not yet assigned	Not reported	[1133022]
Debian	cockpit	source	forky	`360-1`	not yet assigned	Not reported	[1133022]
Debian	cockpit	source	trixie	`337-1+deb13u1`	not yet assigned	Not reported	[1133022]
Debian	cockpit	source	bookworm	`Not affected`	unimportant	Not reported	[1133022]
Opensuse	cockpit	rpm	leap 16.0	`354-160000.3.1`	Not reported	OPENSUSE-SU-2026:20523-1	Not reported
Suse	cockpit	rpm	linux enterprise server 16.0	`354-160000.3.1`	Not reported	SUSE-SU-2026:21184-1	Not reported
Suse	cockpit	rpm	linux enterprise server for sap applications 16.0	`354-160000.3.1`	Not reported	SUSE-SU-2026:21184-1	Not reported
Suse	cockpit	rpm	linux micro 6.2	`354-160000.3.1`	Not reported	SUSE-SU-2026:21106-1	Not reported
Opensuse	cockpit	rpm	tumbleweed	`360-1.1`	Not reported	OPENSUSE-SU-2026:10531-1	Not reported

[Debian bug #1133022]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[cockpit-bridge]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-devel]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-doc]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-firewalld]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-kdump]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-networkmanager]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-packagekit]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-selinux]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-storaged]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-system]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · noarch · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-ws]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed
[cockpit-ws-selinux]Unknown
Source package: [cockpit]
Details (1)
- 365-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 360-1.1
  Version impact unknown
  nvd · cockpit · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[cockpit]Not affected
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-bridge]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · amd64 · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · arm64 · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-doc]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-networkmanager]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-packagekit]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-pcp]Not affected
Source package: [cockpit]
Details (4)
- 287.1-0+deb12u3 · amd64 · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · arm64 · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · amd64 · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · arm64 · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-sosreport]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
[cockpit-storaged]Not affected
Source package: [cockpit]
Details (6)
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u3 · all · bookworm
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 337-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm
- 287.1-0+deb12u2 · all · bookworm-security
  Not affected
  nvd · cockpit · debian · bookworm

Next results

Observed: Oct 27, 2026, 10:37:55 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]