Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Cockpit Machines may reveal passwords and tokens
published 15 days ago
Summary
The Cockpit Machines component used to manage virtual machines can expose sensitive information such as guest passwords and subscription tokens through command‑line and process listings. This could allow anyone with access to the server to see these credentials. Apply the latest security update for Cockpit Machines as soon as possible.
What to do
- Update almalinux cockpit-machines to version 348.1-1.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | cockpit-machines |
< 348.1-1.el10_2 Fix: upgrade to 348.1-1.el10_2
|
Original advisory text
Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:86971 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-92745 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-92747 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-92768 Third Party Advisory
- https://bugzilla.redhat.com/2469258 Third Party Advisory
- https://bugzilla.redhat.com/2469260 Third Party Advisory
- https://bugzilla.redhat.com/2476266 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-86971.html Vendor Advisory
Timeline
Published21 Oct 2026
Updated22 Oct 2026
First seen22 Oct 2026
Sources
ALSA-2026:86971 · OSV
Track software like this
Free during beta