Local Information Exposure in Cockpit-Machines from Red Hat
CVE-2026-92768

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Vendor
CVE Published:
18 September 2026

What is CVE-2026-92768?

A security flaw in the Cockpit-Machines component of Red Hat allows local attackers to access sensitive Virtual Machine (VM) credentials, including plaintext passwords. This vulnerability arises as password values are passed directly via command-line arguments during the creation or installation of VMs, making them susceptible to interception by other local users on systems without restricted process arguments. When exploited, this can lead to unauthorized access and compromise of VM security.

References

https://access.redhat.com/security/cve/CVE-2026-92768
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2469258
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Found by AISLE in partnership with Red Hat.
.