Vulnerability-Lookup

SUSE-SU-2026:21785-1

Vulnerability from csaf_suse - Published: 2026-05-22 09:42 - Updated: 2026-05-22 09:42

Summary

Security update for cockpit

Severity

Important

Notes

Title of the patch: Security update for cockpit

Description of the patch: This update for cockpit fixes the following issues - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040). - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836).

Patchnames: SUSE-SLE-Micro-6.0-726

CVE-2026-25547

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-4802

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 13 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64	—	Vendor Fix

Threats

Impact important

References

12 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1257836	self
https://bugzilla.suse.com/1265040	self
https://www.suse.com/security/cve/CVE-2026-25547/	self
https://www.suse.com/security/cve/CVE-2026-4802/	self
https://www.suse.com/security/cve/CVE-2026-25547	external
https://bugzilla.suse.com/1257834	external
https://www.suse.com/security/cve/CVE-2026-4802	external
https://bugzilla.suse.com/1265040	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for cockpit",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for cockpit fixes the following issues\n\n- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs\n  UI (bsc#1265040).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-726",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21785-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21785-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621785-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21785-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-May/046828.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1257836",
        "url": "https://bugzilla.suse.com/1257836"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265040",
        "url": "https://bugzilla.suse.com/1265040"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25547 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25547/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-4802 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-4802/"
      }
    ],
    "title": "Security update for cockpit",
    "tracking": {
      "current_release_date": "2026-05-22T09:42:26Z",
      "generator": {
        "date": "2026-05-22T09:42:26Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21785-1",
      "initial_release_date": "2026-05-22T09:42:26Z",
      "revision_history": [
        {
          "date": "2026-05-22T09:42:26Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-10.1.aarch64",
                "product": {
                  "name": "cockpit-309-10.1.aarch64",
                  "product_id": "cockpit-309-10.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-10.1.aarch64",
                "product": {
                  "name": "cockpit-bridge-309-10.1.aarch64",
                  "product_id": "cockpit-bridge-309-10.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-10.1.aarch64",
                "product": {
                  "name": "cockpit-ws-309-10.1.aarch64",
                  "product_id": "cockpit-ws-309-10.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-networkmanager-309-10.1.noarch",
                "product": {
                  "name": "cockpit-networkmanager-309-10.1.noarch",
                  "product_id": "cockpit-networkmanager-309-10.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-selinux-309-10.1.noarch",
                "product": {
                  "name": "cockpit-selinux-309-10.1.noarch",
                  "product_id": "cockpit-selinux-309-10.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-storaged-309-10.1.noarch",
                "product": {
                  "name": "cockpit-storaged-309-10.1.noarch",
                  "product_id": "cockpit-storaged-309-10.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-system-309-10.1.noarch",
                "product": {
                  "name": "cockpit-system-309-10.1.noarch",
                  "product_id": "cockpit-system-309-10.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-10.1.s390x",
                "product": {
                  "name": "cockpit-309-10.1.s390x",
                  "product_id": "cockpit-309-10.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-10.1.s390x",
                "product": {
                  "name": "cockpit-bridge-309-10.1.s390x",
                  "product_id": "cockpit-bridge-309-10.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-10.1.s390x",
                "product": {
                  "name": "cockpit-ws-309-10.1.s390x",
                  "product_id": "cockpit-ws-309-10.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-309-10.1.x86_64",
                "product": {
                  "name": "cockpit-309-10.1.x86_64",
                  "product_id": "cockpit-309-10.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-bridge-309-10.1.x86_64",
                "product": {
                  "name": "cockpit-bridge-309-10.1.x86_64",
                  "product_id": "cockpit-bridge-309-10.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ws-309-10.1.x86_64",
                "product": {
                  "name": "cockpit-ws-309-10.1.x86_64",
                  "product_id": "cockpit-ws-309-10.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-10.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64"
        },
        "product_reference": "cockpit-309-10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-10.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x"
        },
        "product_reference": "cockpit-309-10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-309-10.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64"
        },
        "product_reference": "cockpit-309-10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-10.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64"
        },
        "product_reference": "cockpit-bridge-309-10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-10.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x"
        },
        "product_reference": "cockpit-bridge-309-10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-bridge-309-10.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64"
        },
        "product_reference": "cockpit-bridge-309-10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-networkmanager-309-10.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch"
        },
        "product_reference": "cockpit-networkmanager-309-10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-selinux-309-10.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch"
        },
        "product_reference": "cockpit-selinux-309-10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-storaged-309-10.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch"
        },
        "product_reference": "cockpit-storaged-309-10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-system-309-10.1.noarch as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch"
        },
        "product_reference": "cockpit-system-309-10.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-10.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64"
        },
        "product_reference": "cockpit-ws-309-10.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-10.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x"
        },
        "product_reference": "cockpit-ws-309-10.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ws-309-10.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
        },
        "product_reference": "cockpit-ws-309-10.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-25547",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25547"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25547",
          "url": "https://www.suse.com/security/cve/CVE-2026-25547"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257834 for CVE-2026-25547",
          "url": "https://bugzilla.suse.com/1257834"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-22T09:42:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25547"
    },
    {
      "cve": "CVE-2026-4802",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-4802"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
          "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
          "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-4802",
          "url": "https://www.suse.com/security/cve/CVE-2026-4802"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265040 for CVE-2026-4802",
          "url": "https://bugzilla.suse.com/1265040"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:cockpit-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-bridge-309-10.1.x86_64",
            "SUSE Linux Micro 6.0:cockpit-networkmanager-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-selinux-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-storaged-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-system-309-10.1.noarch",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.aarch64",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.s390x",
            "SUSE Linux Micro 6.0:cockpit-ws-309-10.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-22T09:42:26Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-4802"
    }
  ]
}

CVE-2026-25547 (GCVE-0-2026-25547)

Vulnerability from cvelistv5 – Published: 2026-02-04 21:51 – Updated: 2026-02-05 14:31

Title

Uncontrolled Resource Consumption in @isaacs/brace-expansion

Summary

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/isaacs/brace-expansion/securit…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
isaacs	brace-expansion	Affected: < 5.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25547",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T14:24:50.676205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T14:31:38.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "brace-expansion",
          "vendor": "isaacs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T21:51:17.198Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
        }
      ],
      "source": {
        "advisory": "GHSA-7h2j-956f-4vf2",
        "discovery": "UNKNOWN"
      },
      "title": "Uncontrolled Resource Consumption in @isaacs/brace-expansion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25547",
    "datePublished": "2026-02-04T21:51:17.198Z",
    "dateReserved": "2026-02-02T19:59:47.376Z",
    "dateUpdated": "2026-02-05T14:31:38.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4802 (GCVE-0-2026-4802)

Vulnerability from cvelistv5 – Published: 2026-05-11 12:48 – Updated: 2026-05-28 14:57

Title

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

Summary

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Severity

8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

redhat

References

13 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:21390	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21392	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21394	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21395	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21468	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21516	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21647	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21676	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21700	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-4802	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2451155	issue-trackingx_refsource_REDHAT
https://github.com/cockpit-project/cockpit/blob/e…

Impacted products

15 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:356.2-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:334.2-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:310.8-1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:264.3-1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:264.3-1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:264.3-1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6::baseos cpe:/o:redhat:rhel_e4s:8.6::baseos cpe:/o:redhat:rhel_tus:8.6::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:286.2-1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:286.2-1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8::baseos cpe:/o:redhat:rhel_tus:8.8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:356.2-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:356.2-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:264.3-1.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream cpe:/o:redhat:rhel_e4s:9.0::baseos
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:286.3-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/o:redhat:rhel_e4s:9.2::baseos
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:311.3-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream cpe:/o:redhat:rhel_eus:9.4::baseos
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:334.3-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/o:redhat:rhel_eus:9.6::baseos
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2026-05-11 12:34

Credits

Red Hat would like to thank Gabriel Rodrigues (HAKAI) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4802",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T03:55:20.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-20T20:42:55.032Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/20/19"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:356.2-1.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:334.2-1.el10_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:310.8-1.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:264.3-1.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:264.3-1.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_aus:8.6::baseos",
            "cpe:/o:redhat:rhel_e4s:8.6::baseos",
            "cpe:/o:redhat:rhel_tus:8.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:264.3-1.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:286.2-1.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_e4s:8.8::baseos",
            "cpe:/o:redhat:rhel_tus:8.8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:286.2-1.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:356.2-1.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:356.2-1.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream",
            "cpe:/o:redhat:rhel_e4s:9.0::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:264.3-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream",
            "cpe:/o:redhat:rhel_e4s:9.2::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:286.3-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream",
            "cpe:/o:redhat:rhel_eus:9.4::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:311.3-1.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/o:redhat:rhel_eus:9.6::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:334.3-1.el9_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "cockpit",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Gabriel Rodrigues (HAKAI) for reporting this issue."
        }
      ],
      "datePublic": "2026-05-11T12:34:26.148Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T14:57:08.641Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:21390",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21390"
        },
        {
          "name": "RHSA-2026:21392",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21392"
        },
        {
          "name": "RHSA-2026:21394",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21394"
        },
        {
          "name": "RHSA-2026:21395",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21395"
        },
        {
          "name": "RHSA-2026:21468",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21468"
        },
        {
          "name": "RHSA-2026:21515",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21515"
        },
        {
          "name": "RHSA-2026:21516",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21516"
        },
        {
          "name": "RHSA-2026:21647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21647"
        },
        {
          "name": "RHSA-2026:21676",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21676"
        },
        {
          "name": "RHSA-2026:21700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:21700"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-4802"
        },
        {
          "name": "RHBZ#2451155",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451155"
        },
        {
          "url": "https://github.com/cockpit-project/cockpit/blob/e204cd130/pkg/systemd/logsJournal.jsx#L206-L210"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-25T10:32:01.264Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-05-11T12:34:26.148Z",
          "value": "Made public."
        }
      ],
      "title": "Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nOperational risk reduction until fixes are available: restrict access to Cockpit to trusted networks/users only, and avoid opening untrusted crafted Cockpit URLs"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-4802",
    "datePublished": "2026-05-11T12:48:08.657Z",
    "dateReserved": "2026-03-25T10:34:38.394Z",
    "dateUpdated": "2026-05-28T14:57:08.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

SUSE-SU-2026:21785-1

CVE-2026-25547 (GCVE-0-2026-25547)

CVE-2026-4802 (GCVE-0-2026-4802)

Tags

Sightings

Nomenclature