CVE catalog
CVE-2026-92747
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `ro
- Severity
- Medium · CVSS 5
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.17% · Oct 25, 2026
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cockpit-machines | sid | 359-1 | fixed |
| Debian | cockpit-machines | forky | 359-1 | fixed |
| Debian | cockpit-machines | trixie | 332-1 | vulnerable |
| Debian | cockpit-machines | bookworm | 288-1 | vulnerable |
| Fedora | cockpit-machines | 43 | 0:357-1.fc43 | fixed |
| Fedora | cockpit-machines | 44 | 0:357-1.fc44 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cockpit-machines | source | sid | 357-1 | not yet assigned | Not reported | Not reported |
| Debian | cockpit-machines | source | forky | 357-1 | not yet assigned | Not reported | Not reported |
| Debian | cockpit-machines | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | cockpit-machines | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Fedora | cockpit-machines | rpm | 43 | 0:357-1.fc43 | Not reported | FEDORA-2026-4923296720#CVE-2026-92747 | Not reported |
| Fedora | cockpit-machines | rpm | 44 | 0:357-1.fc44 | Not reported | FEDORA-2026-57E39FC2FA#CVE-2026-92747 | Not reported |
Notes
[trixie] cockpit-machines: Minor issue [bookworm] cockpit-machines: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [cockpit-machines]Affected
Details (4)
288-1· all · bookwormAffected
nvd · cockpit-machines · debian · bookworm; nvd · cockpit-machines · debian · 12
288-1· all · bookwormAffected
nvd · cockpit-machines · debian · bookworm; nvd · cockpit-machines · debian · 12
332-1~bpo12+1· all · bookworm-backportsAffected
nvd · cockpit-machines · debian · bookworm; nvd · cockpit-machines · debian · 12
332-1~bpo12+1· all · bookworm-backportsAffected
nvd · cockpit-machines · debian · bookworm; nvd · cockpit-machines · debian · 12
[Debian 13 (Trixie)]
- [cockpit-machines]Affected
Details (4)
332-1· all · trixieAffected
nvd · cockpit-machines · debian · 13
332-1· all · trixieAffected
nvd · cockpit-machines · debian · 13
355-1~bpo13+1· all · trixie-backportsAffected
nvd · cockpit-machines · debian · 13
355-1~bpo13+1· all · trixie-backportsAffected
nvd · cockpit-machines · debian · 13
[Fedora 43]
- [cockpit-machines]Unknown
Source package: [cockpit-machines]
Details (4)
341-1.fc43· noarch · 43Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 43
341-1.fc43· noarch · 43Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 43
355-1.fc43· noarch · 43Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 43
355-1.fc43· noarch · 43Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 43
[Fedora 44]
- [cockpit-machines]Unknown
Source package: [cockpit-machines]
Details (4)
350-1.fc44· noarch · 44Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 44
350-1.fc44· noarch · 44Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 44
355-1.fc44· noarch · 44Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 44
355-1.fc44· noarch · 44Unknown
Version impact unknown
nvd · cockpit-machines · fedora · 44
Observed:
References
- [https://bodhi.fedoraproject.org/updates/FEDORA-2026-57e39fc2fa]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537074]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537075]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2537076]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_86971.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-92747]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-92747]
- [https://security-tracker.debian.org/tracker/CVE-2026-92747]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92747.json]
[Debian Security Tracker] · [FIRST EPSS] · [Fedora security updates (Bodhi)] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]