← CVE Intelligence

CVE-2026-4802

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui PUBLISHED

Description (CNA)

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux 10unaffected 0:356.2-1.el10_2 before *
Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:334.2-1.el10_0 before *
Red Hat / Red Hat Enterprise Linux 8unaffected 0:310.8-1.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:264.3-1.el8_6 before *
Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 0:264.3-1.el8_6 before *
Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 0:264.3-1.el8_6 before *
Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 0:286.2-1.el8_8 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 0:286.2-1.el8_8 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:356.2-1.el9_8 before *
Red Hat / Red Hat Enterprise Linux 9unaffected 0:356.2-1.el9_8 before *
Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:264.3-1.el9_0 before *
Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:286.3-1.el9_2 before *
Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:311.3-1.el9_4 before *
Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:334.3-1.el9_6 before *
Red Hat / Red Hat Enterprise Linux 7unaffected

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

redhat-SADP

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.