CVE-2026-4631

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Cockpit enables users to administer GNU/Linux servers using a web browser. It
offers network configuration, log inspection, diagnostic reports, SELinux
troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Cockpit enables users to administer GNU/Linux servers using a web browser. It
offers network configuration, log inspection, diagnostic reports, SELinux
troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

• CVE-2026-4631: Fix SSH command-line argument injection in cockpit-ws / beiboot (Critical RCE)

Unauthenticated remote code execution due to ssh command-line argument injection. (CVE-2026-4631)

CVE-2026-4631, Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. CVE-2026-4800, lodash vulnerable to Code Injection via _.template imports key names CVE-2026-4802, A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

These are all security issues fixed in the cockpit-360-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cockpit fixes the following issues:

Changes in cockpit:

• CVE-2026-4631: Avoid ssh command injection that could be used to cause remote code execution (bsc#1261829)

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

This update for cockpit fixes the following issues:

Changes in cockpit:

• CVE-2026-4631: Avoid ssh command injection that could be used to cause remote code execution (bsc#1261829)

This update for cockpit fixes the following issues:

Changes in cockpit:

• CVE-2026-4631: Avoid ssh command injection that could be used to cause remote code execution (bsc#1261829)

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

• CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes (bsc#1257325).
• CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
• CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
• CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
• CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

• cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
• cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).

Changes for cockpit:

• Update to 364.

• Update to 361 (jsc#PED-15706/jsc#CPT-183):

• Remove all "Mount" actions in Anaconda mode
• Dependency updates

• Update to 360:

• ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
• ws: support loading a custom login page

• Update to 358:

• Networking: Add Wi-Fi support
• Cockpit Client updated to GTK 4
• Bugfixes and translation updates

• Update to 357:

• lib: Use browser context menu on shift
• bridge: support Python 3.14 on old kernels (RHEL 8)

• Update to 356:

• systemd: Allow editing timers created by Cockpit
• Convert license headers to SPDX format

• Update to 355:

• ws: Remove obsolete pam_cockpit_cert module
• shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

• Update to 354.

• Update to 352:

• Improvements to the "Add disk" and "Create Volume" dialogs.

• Update suse_version requirement to function with the planned bump (jsc#PED-15820).

• Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

• Update to 348:

• Translation updates
• Convert license headers to SPDX format
• Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl

• Update to 347:

• Bug fixes and translation updates

• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

• Update to version 5:

• Support transactional systems
• Improve error/success messages
• Translation updates

• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

• Update to 128.
• Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

• Update to 4.8.
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

• Update to version 16.2 (bsc#1257033).
• Patch esbuild to use native runtime on ppc64 (bsc#1257698).