{"id":"CVE-2026-92745","aliases":["ALSA-2026:86970","ALSA-2026:86971","DEBIAN-CVE-2026-92745","EUVD-2026-83260","GHSA-gp59-h6j7-4p3h","RLSA-2026:86970","RLSA-2026:86971","UBUNTU-CVE-2026-92745"],"status":"published","title":"Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00106,"percentile":0.01113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-214"],"published":"2026-09-18T17:53:29Z","modified":"2026-11-11T12:31:31Z","fixes":[{"ecosystem":"Debian:14","package":"cockpit-machines","fixed_in":["357-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"348.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"348.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["288-1","292-1","293-1","294-1","295-1","295-1~bpo12+1","296-1","297-1","297-1~bpo12+1","298-1","298-1~bpo12+1","299-1","299-1~bpo12+1","300-1","300-1~bpo12+1","301-1","302-1","302-1~bpo12+1","303-1","303-1~bpo12+1","304-1","304-1~bpo12+1","305-1","305-1~bpo12+1","306-1","307-1","307-1~bpo12+1","309-1","309-1~bpo12+1","310-1","310-1~bpo12+1","312-1","313-1","313-2","313-3","314-1","314-2","314-2~bpo12+1","315-1","315-1~bpo12+1","316-1","317-1","317-1~bpo12+1","318-1","318-1~bpo12+1","319-1","319-1~bpo12+1","320-1","320-1~bpo12+1","321-1","322-1","323-1","323-1~bpo12+1","324-1","324-1~bpo12+1","325-1","325-2","326-1","327-1","327-1~bpo12+1","328-1","329-1","329-1~bpo12+1","330-1","331-1","332-1","332-1~bpo12+1","334-1","335-1","336-1","338-1","338-1~bpo13+1","339-1","339-1~bpo13+1","341-1","341-1~bpo13+1","343-1","343-1~bpo13+1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","347-1","347-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","351-1","351-1~bpo13+1","353-1","353-2","353-3","353-3~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","357-1","357-1~bpo13+1","359-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["332-1","334-1","335-1","336-1","338-1","338-1~bpo13+1","339-1","339-1~bpo13+1","341-1","341-1~bpo13+1","343-1","343-1~bpo13+1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","347-1","347-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","351-1","351-1~bpo13+1","353-1","353-2","353-3","353-3~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","357-1","357-1~bpo13+1","359-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"357-1"}]}],"versions":["332-1","334-1","335-1","336-1","338-1","338-1~bpo13+1","339-1","339-1~bpo13+1","341-1","341-1~bpo13+1","343-1","343-1~bpo13+1","345-1","345-1~bpo13+1","346-1","346-1~bpo13+1","347-1","347-1~bpo13+1","348-1","348-1~bpo13+1","350-1","350-1~bpo13+1","351-1","351-1~bpo13+1","353-1","353-2","353-3","353-3~bpo13+1","355-1","355-1~bpo13+1","356-1","356-1~bpo13+1","357-1~bpo13+1"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:348.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:348.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["251-1","254-1","255-1","256-1","258-1","259-1","260-1","261-1","262-1","263-1","264-1","265-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["299-1","300-1","301-1","302-1","303-1","304-1","305-1","306-1","307-1","310-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["351-1","353-3","355-1","355-1ubuntu1","356-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cockpit-machines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["339-1","341-1","343-1","345-1","346-1","347-1","348-1","351-1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:86970","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86971","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98459","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92745","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476266","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92745"},{"url":"https://github.com/advisories/GHSA-gp59-h6j7-4p3h"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92747","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92768","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469258","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469260","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476266","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86970.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86971.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-92745","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86970","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469260","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86971","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-92745","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92745","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-92745","title":"Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T17:53:29.077Z","modified":"2026-11-11T11:49:48.21Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-214"],"updated_at":"2026-11-11T12:57:44.071307Z"}],"euvd":[{"id":"EUVD-2026-83260","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T17:53:29Z","modified":"2026-11-11T11:49:48Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-11T13:28:43.052864Z"}],"ghsa":[{"id":"GHSA-gp59-h6j7-4p3h","title":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability...","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T18:31:44Z","modified":"2026-11-11T12:31:31Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-214"],"updated_at":"2026-11-11T12:34:05.637143Z"}],"nvd":[{"id":"CVE-2026-92745","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T18:18:16.41Z","modified":"2026-10-21T14:17:22.133Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-214"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-92745","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T18:18:16.41Z","modified":"2026-10-23T18:05:19.515905523Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"RLSA-2026:86970","title":"Moderate: cockpit-machines security update","description":"Cockpit component for managing libvirt virtual machines.\n\nSecurity Fix(es):\n\n* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)\n\n* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)\n\n* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:04:07.745746Z","modified":"2026-10-22T00:30:03.393364789Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:86971","title":"Moderate: cockpit-machines security update","description":"Cockpit component for managing libvirt virtual machines.\n\nSecurity Fix(es):\n\n* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)\n\n* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)\n\n* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:08:23.571327Z","modified":"2026-10-22T00:30:04.995327923Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-92745","description":"A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.","status":"published","published":"2026-09-18T18:18:00Z","modified":"2026-10-17T13:01:17.679245221Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"ALSA-2026:86970","title":"Moderate: cockpit-machines security update","description":"Cockpit component for managing libvirt virtual machines.  \n\nSecurity Fix(es):  \n\n  * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)\n  * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)\n  * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-29T11:32:38.536740523Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:86971","title":"Moderate: cockpit-machines security update","description":"Cockpit component for managing libvirt virtual machines.  \n\nSecurity Fix(es):  \n\n  * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)\n  * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)\n  * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-29T11:31:00.409480632Z","updated_at":"2026-11-02T15:27:57.367731Z"}]}}