https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T10:17:01.169655+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-92747 fkie_cve-2026-92747 2026-09-28T10:17:01.284022+00:00

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.

 https://db.gcve.eu/vuln/ghsa-8p9r-6652-9xc4 GHSA-8p9r-6652-9xc4 2026-09-28T10:17:01.284111+00:00

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-92747 UBUNTU-CVE-2026-92747 2026-09-28T10:17:01.284133+00:00

Affected: Ubuntu:22.04:LTS: cockpit-machines, Ubuntu:24.04:LTS: cockpit-machines, Ubuntu:26.04:LTS: cockpit-machines

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.