CVE-2026-91149
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain numerous simultaneous connections to the cockpit-tls service, forcing it to create an unbounded number of threads and consume system resources such as memory and file descriptors. The result is a denial of service (DoS).
Risk Assessment
The attack can lead to degradation or complete unavailability of the Cockpit service for legitimate users, disrupting system management.
Recommendation
Apply connection limits and resource constraints for the cockpit-tls service. Install security updates from the vendor.
Other vulnerabilities in Cockpit
See all- CVE-2026-4631Critical
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials.
- CVE-2026-91142Low
A vulnerability in Cockpit on ILP32 builds involves an integer overflow in the `do_lastlog()` function, specifically in offset calculation for lastlog entries. A low-privileged user with a specially provisioned large UID can cause the offset to wrap, allowing unauthorized reads and writes to other users' lastlog records, potentially disclosing or altering login information.
- CVE-2026-4802High
A flaw was found in Cockpit that allows a remote attacker to execute arbitrary commands on the host by exploiting unsanitized user-controlled parameters in the system logs UI. An attacker can inject shell metacharacters and command substitutions, leading to arbitrary shell command execution on the affected system.
- CVE-2026-38993Medium
Directory traversal vulnerability in the Buckets component of Cockpit 2.13.5 and earlier. Allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
Original NVD description (English source)
A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS