CVE-2026-92768
mediumA flaw was found in cockpit-machines.
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/errata/RHSA-2026:86970 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:86971 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-92768 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 134c704f-9b21-4f2e-91b3-4a467353bcc0