CVE-2026-4802

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.

Security Fix(es):

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.

Security Fix(es):

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It
offers network configuration, log inspection, diagnostic reports, SELinux
troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Arbitrary command execution via crafted links in system logs

UI (CVE-2026-4802)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

• CVE-2026-4802: fix arbitrary command execution via crafted links in the system logs UI

• CVE-2026-4802: fix shell command injection via boot descriptor query string in the system logs page by quoting journalctl arguments using shlex-style single- quote escaping

• CVE-2024-6126: fix insecure killing of session ssh-agent; include upstream follow-up commit for proper strtoul() error handling when parsing SSH_AGENT_PID

CVE-2026-4631, Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. CVE-2026-4800, lodash vulnerable to Code Injection via _.template imports key names CVE-2026-4802, A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

These are all security issues fixed in the cockpit-361-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cockpit fixes the following issue

• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

This update for cockpit fixes the following issues

• CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user (bsc#1256521).
• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
• CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead to DoS (bsc#1259290).

This update for cockpit fixes the following issues

• CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user (bsc#1256521).
• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
• CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead to DoS (bsc#1259290).

This update for cockpit fixes the following issues

• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836).

This update for cockpit fixes the following issue

• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

This update for cockpit fixes the following issues

• CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257838).
• CVE-2026-27606: rollup: Arbitrary File Write via Path Traversal in Rollup 4 (bsc#1258900).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259015).