Privileged Symlink Dereference Vulnerability in Cockpit by Red Hat
CVE-2026-91151
7.3HIGH
What is CVE-2026-91151?
A vulnerability exists in Cockpit that allows a local authenticated user who controls a target account's home directory to exploit a flaw in the ssh-add-public-key.sh helper. This helper, when executed with elevated privileges, can be manipulated into following attacker-controlled symbolic links located in the user’s .ssh or authorized_keys directories. As a consequence, the attacker may alter file ownership and permissions arbitrarily, resulting in potential local privilege escalation that jeopardizes the integrity, confidentiality, and overall availability of the system.
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was discovered by Found by AISLE in partnership with Red Hat.