CVE-2026-91151

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.

Security Fix(es):

• cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper (CVE-2026-91151)

• cockpit: cockpit: Denial of Service via unbounded fragmented WebSocket messages (CVE-2026-91150)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the ssh-add-public-key.sh helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the .ssh or authorized_keys paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.