CVE-2026-92768
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
Risk Assessment
A local attacker can obtain VM passwords, potentially leading to unauthorized access to those machines and their data. Organizations using cockpit-machines on shared systems are exposed to credential leakage.
Recommendation
Restrict process argument visibility for unprivileged users or update cockpit-machines to a version that does not pass passwords on the command line. Consider using safer credential passing mechanisms such as environment variables or temporary files with restricted access.
Other vulnerabilities in cockpit-machines
See all- CVE-2026-113496Medium
A flaw was found in cockpit-machines where the VNC console password is passed directly as a command-line argument to a system utility. A local unprivileged attacker on a host allowing cross-user process inspection could read the exposed password from the process list.
- CVE-2026-113495Medium
A flaw was found in cockpit-machines where RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval. A local unprivileged attacker on a system permitting cross-user process inspection can view these arguments.
- CVE-2026-92747Medium
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
- CVE-2026-92745Medium
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
Original NVD description (English source)
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS