9.8

CVE-2026-4631: Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

Awaiting analysis
AliasesMGASA-2026-0099SUSE-SU-2026:21106-1SUSE-SU-2026:21184-1
Published 07-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-4631 is a critical (CVSS 9.8) vulnerability in cockpit. EPSS estimates a 15.48% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (exploit-database, 21-05-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
15.48%
0%100%
Medium · +6.26 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 6 · Related 3
CVE-2021-23337MGASA-2026-0175OPENSUSE-SU-2026:21399-1RHBA-2026:21388SUSE-SU-2026:22770-1SUSE-SU-2026:22837-1

Timeline

  1. 07-04-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

15.48%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

Increase +6.26 pp

From 9.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • exploit-databasemultipleUnverified

    Cockpit 359 - RCE

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat10 products
  • cockpit< 0:334.1-3.el10_0 | < 0:334.2-2.el9_6 | < 0:344-3.el10_1 | < 0:344-2.el9_7
  • cockpit-bridge< 0:334.1-3.el10_0 | < 0:334.2-2.el9_6 | < 0:344-3.el10_1 | < 0:344-2.el9_7
  • cockpit-debuginfo< 0:334.1-3.el10_0 | < 0:334.2-2.el9_6 | < 0:344-3.el10_1 | < 0:344-2.el9_7
  • cockpit-debugsource< 0:334.1-3.el10_0 | < 0:334.2-2.el9_6 | < 0:344-3.el10_1 | < 0:344-2.el9_7
  • cockpit-doc< 0:334.1-3.el10_0 | < 0:334.2-2.el9_6 | < 0:344-3.el10_1 | < 0:344-2.el9_7
Suse3 products
  • cockpit&distro=SUSE Linux Enterprise Server 16.0< 354-160000.3.1
  • cockpit&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 354-160000.3.1
  • cockpit&distro=SUSE Linux Micro 6.2< 354-160000.3.1
Opensuse2 products
  • cockpit&distro=openSUSE Leap 16.0< 354-160000.3.1
  • cockpit&distro=openSUSE Tumbleweed< 360-1.1
Debian1 product
  • cockpit< 337-1+deb13u1 | < 360-1
Mageia1 product
  • cockpit< 338-1.7.mga9
Ubuntu1 product
  • cockpitAll versions (No fix recorded)

6 vendors · 18 products

References

27 links
Show all 27 references