RHSA-2026:94485MediumCVSS 7.5

Red Hat Security Advisory: cockpit security, bug fix, and enhancement update

Published
November 3, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (2)

CVE-2026-91147 →CVE-2026-76235 →

📋 Description

CVE-2026-76235 — cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html CVE-2026-91147 — cockpit: Cockpit: Denial of Service in cockpit-ws due to URL-root handling without a trailing slash

🎯 Affected products24

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-0:310.10-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-0:310.10-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-0:310.10-1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-0:310.10-1.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-0:310.10-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-bridge-0:310.10-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-bridge-0:310.10-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-bridge-0:310.10-1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-bridge-0:310.10-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debuginfo-0:310.10-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debuginfo-0:310.10-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debuginfo-0:310.10-1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debuginfo-0:310.10-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debugsource-0:310.10-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debugsource-0:310.10-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debugsource-0:310.10-1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-debugsource-0:310.10-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-doc-0:310.10-1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-system-0:310.10-1.el8_10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-ws-0:310.10-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-ws-0:310.10-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-ws-0:310.10-1.el8_10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • cockpit-ws-0:310.10-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict network access to the cockpit port to trusted clients until a fix is available. No configuration-level mitigation removes the flaw entirely, since the login page must remain reachable without authentication. Workaround: A code fix is being pursued for the affected streams. Until updated packages are available, avoid configuring a non-empty [WebService] UrlRoot in cockpit-ws where feasible. If a non-empty UrlRoot is required, configure the front-end proxy or TLS terminator in front of cockpit-ws to rewrite or redirect requests for the exact configured prefix (for example, /cockpit) to the trailing-slash form (for example, /cockpit/) before forwarding them, so the exact-prefix request never reaches cockpit-ws unnormalized. Deployments whose front end already normalizes or redirects such requests are not exposed through that route.

🔗 References (6)