CVE catalog
CVE-2026-91203
DEBIAN-CVE-2026-91203
- Severity
- Medium · CVSS 6
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.11% · Oct 25, 2026
A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cockpit-files | 14 | 36-1 | vulnerable |
| Debian | cockpit-files | 14 | 36-1~bpo13+1 | vulnerable |
| Debian | cockpit-files | 14 | 38-1 | vulnerable |
| Debian | cockpit-files | 14 | 39-1 | vulnerable |
| Debian | cockpit-files | 14 | 40-1 | vulnerable |
| Debian | cockpit-files | 14 | 41-1 | vulnerable |
| Debian | cockpit-files | 14 | 43-1 | vulnerable |
| Debian | cockpit-files | 14 | 43-1~bpo13+1 | vulnerable |
| Debian | cockpit-files | 14 | 44-1 | vulnerable |
| Debian | cockpit-files | 14 | 44-1~bpo13+1 | vulnerable |
| Debian | cockpit-files | 14 | 45-1~bpo13+1 | vulnerable |
| Debian | cockpit-files | 14 | 45-1 | fixed |
| Fedora | cockpit-files | 43 | 0:45-1.fc43 | fixed |
| Fedora | cockpit-files | 44 | 0:45-1.fc44 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cockpit-files | deb | 14 | 45-1 | Not reported | DEBIAN-CVE-2026-91203 | Not reported |
| Fedora | cockpit-files | rpm | 43 | 0:45-1.fc43 | Not reported | FEDORA-2026-A643AE21D6#CVE-2026-91203 | Not reported |
| Fedora | cockpit-files | rpm | 44 | 0:45-1.fc44 | Not reported | FEDORA-2026-D8F5999539#CVE-2026-91203 | Not reported |
OpenFactory catalog packages
[Fedora 43]
- [cockpit-files]Unknown
Source package: [cockpit-files]
Details (4)
29-1.fc43· noarch · 43Unknown
Version impact unknown
pypi · cockpit-files · fedora · 43
29-1.fc43· noarch · 43Unknown
Version impact unknown
pypi · cockpit-files · fedora · 43
43-1.fc43· noarch · 43Unknown
Version impact unknown
pypi · cockpit-files · fedora · 43
43-1.fc43· noarch · 43Unknown
Version impact unknown
pypi · cockpit-files · fedora · 43
[Fedora 44]
- [cockpit-files]Unknown
Source package: [cockpit-files]
Details (4)
39-1.fc44· noarch · 44Unknown
Version impact unknown
pypi · cockpit-files · fedora · 44
39-1.fc44· noarch · 44Unknown
Version impact unknown
pypi · cockpit-files · fedora · 44
43-1.fc44· noarch · 44Unknown
Version impact unknown
pypi · cockpit-files · fedora · 44
43-1.fc44· noarch · 44Unknown
Version impact unknown
pypi · cockpit-files · fedora · 44
Observed:
References
- [https://bodhi.fedoraproject.org/updates/FEDORA-2026-d8f5999539]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537070]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537071]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537077]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-91203]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91203.json]
[FIRST EPSS] · [Fedora security updates (Bodhi)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]