CVE-2026-91149
Cockpit: cockpit: denial of service via unbounded connection thread spawning
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used 7.5
Cockpit: cockpit: denial of service via unbounded connection thread spawning
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
CVE-2026-91149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-11
EUVDEUVD-2026-83174 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
EUVD-2026-83174- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-3m8q-36jp-wgm3 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by...
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
GHSA-3m8q-36jp-wgm3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-11
NVD 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
CVE-2026-91149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-91149 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
DEBIAN-CVE-2026-91149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
OSVRHSA-2026:94533 7.5
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:94533- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
Show 9 moreShow less
OSVRHSA-2026:96250 7.5
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:96250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98463 7.5
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:98463- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2026:98567 7.5
Red Hat Security Advisory: cockpit security update
- Record
RHSA-2026:98567- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRLSA-2026:94533 7.5
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:94533- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVRLSA-2026:96250 7.5
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:96250- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-10
OSVRLSA-2026:98567 7.5
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147)cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:98567- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVUBUNTU-CVE-2026-91149 7.5
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
- Record
UBUNTU-CVE-2026-91149- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:94533No score
Important: cockpit security update
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
- cockpit: Cockpit: Denial of Service in
cockpit-wsdue to URL-root handling without a trailing slash (CVE-2026-91147) - cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)
- cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:94533- Updated
- 2026-11-04
OSVopenSUSE-SU-2026:12427-1No score
cockpit-370-1.1 on GA media
These are all security issues fixed in the cockpit-370-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12427-1- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cockpitAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-bridgeAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-docAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-packagekitAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-storagedAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-systemAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-wsAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpit-ws-selinuxAlmaLinux:9 From an advisory covering 3 CVEs | before 356.4-1.el9_8 | 356.4-1.el9_8 |
cockpitDebian:12 | All versions, plus listed versions 287-1287.1-0+deb12u1287.1-0+deb12u2287.1-0+deb12u3288.1-1 Show 45 moreShow less289-1290-1291-1292-1293-1294-1294.1-1295-1296-1297-1297-1~bpo12+1298-1299-1299-1~bpo12+1300-1300.1-1300.1-1~bpo12+1301-1301-1~bpo12+1302-1303-1303-1~bpo12+1304-1305-1305-1~bpo12+1306-1306-1~bpo12+1307-1307-1~bpo12+1308-1308-1~bpo12+1309-1309-1~bpo12+1310-1310.1-1310.1-1~bpo12+1311-1311-1~bpo12+1312-1313-1314-1316-1317-1317-2317-3 | None known |
cockpitDebian:13 | All versions, plus listed versions 337-1337-1+deb13u1337-1+deb13u2338-1339-1 Show 41 moreShow less340-1341.1-1342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1366-1~bpo13+1367-1367-1~bpo13+1368-1368-1~bpo13+1370-1370-1~bpo13+1371-1371-1~bpo13+1372-1 | None known |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cockpitDebian:14 | before 368-1, plus listed versions 337-1338-1339-1340-1341.1-1 Show 33 moreShow less342-1343-1345-1345-1~bpo13+1346-1346-1~bpo13+1348-1348-1~bpo13+1350-1350-1~bpo13+1352-1352-1~bpo13+1353.1-1353.1-1~bpo13+1354-1354-1~bpo13+1355-1355-1~bpo13+1356-1356-1~bpo13+1358-1358-1~bpo13+1360-1360-1~bpo13+1362-1362-1~bpo13+1365-1365-1~bpo13+1366-1366-1~bpo13+1367-1367-1~bpo13+1368-1~bpo13+1 | 368-1 |
cockpit-packagekitRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-storagedRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpitRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-bridgeRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-docRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-systemRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-wsRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-ws-selinuxRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:356.4-1.el9_8 | 0:356.4-1.el9_8 |
cockpit-packagekitRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-storagedRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpitRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-bridgeRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-docRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-systemRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-wsRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-ws-selinuxRed Hat:enterprise_linux:10.2 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2 | 0:356.4-1.el10_2 |
cockpit-packagekitRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-storagedRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpitRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-bridgeRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-debuginfoRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-debugsourceRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-docRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-systemRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-wsRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-ws-selinuxRed Hat:enterprise_linux:9::baseos From an advisory covering 3 CVEs | before 0:366.1-1.el9_9 | 0:366.1-1.el9_9 |
cockpit-packagekitRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-storagedRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpitRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-bridgeRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-debuginfoRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-debugsourceRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-docRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-systemRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-wsRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpit-ws-selinuxRed Hat:enterprise_linux:10.3 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3 | 0:366.1-1.el10_3 |
cockpitRocky Linux:9 From an advisory covering 3 CVEs | before 0:356.4-1.el9_8.rocky.0.1 | 0:356.4-1.el9_8.rocky.0.1 |
cockpitRocky Linux:10 From an advisory covering 3 CVEs | before 0:356.4-1.el10_2.rocky.0.1 | 0:356.4-1.el10_2.rocky.0.1 |
cockpit-packagekitRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-storagedRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-bridgeRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-docRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-systemRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-debuginfoRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-wsRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-debugsourceRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpit-ws-selinuxRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpitRocky Linux:10 From an advisory covering 3 CVEs | before 0:366.1-1.el10_3.rocky.0.1 | 0:366.1-1.el10_3.rocky.0.1 |
cockpitUbuntu:18.04:LTS | All versions, plus listed versions 151-1156-1157-1158-1160-1 Show 4 moreShow less161-1162-1163-1164-1 | None known |
cockpitUbuntu:20.04:LTS | All versions, plus listed versions 202.1-1204-1206-1207-1208-1 Show 6 moreShow less210-1211-1212-1213-1214.1-1215-1 | None known |
cockpitUbuntu:22.04:LTS | All versions, plus listed versions 252-1256-1257-1258-1259-1 Show 6 moreShow less260-1261-1262-1263-1264-1264-1ubuntu0.22.04.1 | None known |
cockpitUbuntu:24.04:LTS | All versions, plus listed versions 300.1-1303-1304-1305-1306-1 Show 7 moreShow less307-1308-1309-1310.1-1311-1312-1build2314-1 | None known |
cockpitUbuntu:26.10 | All versions, plus listed versions 360-1362-1365-1367-1 | None known |
cockpitUbuntu:26.04:LTS | All versions, plus listed versions 346-1348-1350-1352-1353.1-1 Show 4 moreShow less354-1355-1356-1360-1 | None known |
cockpitopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 370-1.1 | 370-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List, EUVD, GitHub Advisories, NVD | |
| references | CVE List | |
| affected, aliases, references | OSV | |
| affected | EUVD, GitHub Advisories, NVD, OSV | |
| references | CVE List | |
| affected, aliases, references | OSV | |
| affected |
Show 5 moreShow less
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| facts, references | CVE List, GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91149 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in cockpit 368-1.
References
access.redhat.com/errata/RHSA-2026:94533
access.redhat.com/errata/RHSA-2026:96250
access.redhat.com/errata/RHSA-2026:98463
access.redhat.com/errata/RHSA-2026:98567
access.redhat.com/security/cve/CVE-2026-91149
bugzilla.redhat.com/show_bug.cgi?id=2479422
Show 28 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-91149
github.com/advisories/GHSA-3m8q-36jp-wgm3
access.redhat.com/security/cve/CVE-2026-76235
access.redhat.com/security/cve/CVE-2026-91147
bugzilla.redhat.com/2479230
bugzilla.redhat.com/2479422
bugzilla.redhat.com/2519497
errata.almalinux.org/9/ALSA-2026-94533.html
security-tracker.debian.org/tracker/CVE-2026-91149
access.redhat.com/security/updates/classification
bugzilla.redhat.com/show_bug.cgi?id=2479230
bugzilla.redhat.com/show_bug.cgi?id=2519497
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94533.json
cve.org/CVERecord?id=CVE-2026-76235
nvd.nist.gov/vuln/detail/CVE-2026-76235
cve.org/CVERecord?id=CVE-2026-91147
nvd.nist.gov/vuln/detail/CVE-2026-91147
cve.org/CVERecord?id=CVE-2026-91149
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96250.json
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98463.json
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98567.json
errata.rockylinux.org/RLSA-2026:94533
errata.rockylinux.org/RLSA-2026:96250
errata.rockylinux.org/RLSA-2026:98567
ubuntu.com/security/CVE-2026-91149
suse.com/security/cve/CVE-2026-91147
suse.com/security/cve/CVE-2026-91148
suse.com/security/cve/CVE-2026-91149
Left out here: 85 versions. The JSON record has them.