CVE-2026-4631
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials.
Risk Assessment
The risk for the organization includes unauthorized code execution on the Cockpit server, potentially leading to system compromise, data theft, or further attacks on the IT infrastructure.
Recommendation
Immediately update Cockpit to a version that includes input validation fixes for the remote login feature. Until the update is applied, restrict network access to the Cockpit service to trusted IP addresses only.
Other vulnerabilities in Cockpit
See all- CVE-2026-91149High
A vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain numerous simultaneous connections to the cockpit-tls service, forcing it to create an unbounded number of threads and consume system resources such as memory and file descriptors. The result is a denial of service (DoS).
- CVE-2026-91142Low
A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.
- CVE-2026-4802High
A flaw was found in Cockpit that allows a remote attacker to execute arbitrary commands on the host by exploiting unsanitized user-controlled parameters in the system logs UI. An attacker can inject shell metacharacters and command substitutions, leading to arbitrary shell command execution on the affected system.
- CVE-2026-38993Medium
Directory traversal vulnerability in the Buckets component of Cockpit 2.13.5 and earlier. Allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
- CVE-2026-6626Medium
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5 affecting some unknown functionality of the Asset Handler/Aggregate Handler component. The manipulation results in improper neutralization of special elements in data query logic. The attack can be launched remotely, and the exploit is now public.
Original NVD description (English source)
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS