CVE-2026-91147

MediumCVSS 5.9

Published: 18/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

In cockpit-ws, there is a denial-of-service (DoS) vulnerability. A remote unauthenticated attacker can send a specially crafted request that, when WebService.UrlRoot is configured and the exact URL-root prefix is requested without a trailing slash, causes the service to terminate unexpectedly.

Risk Assessment

The attack can lead to unavailability of the Cockpit service, preventing system management through the web interface.

Recommendation

Upgrade cockpit-ws to a patched version or apply an available workaround.

Other vulnerabilities in cockpit-ws

CVE-2026-76235High
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

Original NVD description (English source)

A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS