CVE-2026-4802
HighCVSS 8.0Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A flaw was found in Cockpit that allows a remote attacker to execute arbitrary commands on the host by exploiting unsanitized user-controlled parameters in the system logs UI. An attacker can inject shell metacharacters and command substitutions, leading to arbitrary shell command execution on the affected system.
Risk Assessment
The risk for the organization is critical as a remote attacker can gain full control over the system, potentially leading to data theft, service disruption, or further propagation of the attack within the network.
Recommendation
Immediately update Cockpit to the latest patched version and restrict access to the system logs UI to trusted users only.
Other vulnerabilities in Cockpit
See all- CVE-2026-4631Critical
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials.
- CVE-2026-38993Medium
Directory traversal vulnerability in the Buckets component of Cockpit 2.13.5 and earlier. Allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
Original NVD description (English source)
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.