Описание
Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
-
cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
-
cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
-
cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 10
Связанные CVE
Ссылки на источники
Исправления
- Red Hat - 2469258
- Red Hat - 2469260
- Red Hat - 2476266
Связанные уязвимости
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.