CVE-2026-4631: fallo crítico en Red Hat Enterprise Linux 10
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
Publicada el · Actualizada el
85Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 9.2%
de la publicación al arma11 días
Publicada en NVD7 abr
1ª PoC+11d
VulnCheck+92d
probabilidad de explotación
9.2%top 5% de las CVE
explotación observada
síVulnCheck
5 exploit(s) público(s)
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.6 Extended Update SupportPoCs públicas encontradas — 5
exploitdbwww.exploit-db.com/exploits/52572no verificadogithubgithub.com/cyberheartmi9/CVE-2026-4631-cockpit-RCE★ 14githubgithub.com/ExDev994/CVE-2026-4631-cockpit-RCE★ 0vulncheckvulncheck.com/xdb/f977ca407281no verificadovulncheckvulncheck.com/xdb/9de392bd75b2no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Red Hat Enterprise Linux 10
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-4911HIGHGlibc: buffer overflow in ld.so leading to privilege escalationEPSS 63.8%KEVCVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2023-46847HIGHSquid: denial of service in http digest authenticationEPSS 88.4%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 86.0%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.1%CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.6%
Referencias
https://access.redhat.com/errata/RHSA-2026:7381https://access.redhat.com/errata/RHSA-2026:7382https://access.redhat.com/errata/RHSA-2026:7383https://access.redhat.com/errata/RHSA-2026:7384https://access.redhat.com/security/cve/CVE-2026-4631https://bugzilla.redhat.com/show_bug.cgi?id=2450246https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4631.jsonhttp://www.openwall.com/lists/oss-security/2026/04/10/5