CVE-2026-4631
CriticalExploitedPublic exploitCockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization.
Published Apr 7, 2026 · Updated Oct 15, 2026 · Also known as DEBIAN-CVE-2026-4631, UBUNTU-CVE-2026-4631
Key Facts
Patch immediately- CVE-2026-4631 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting 9 (Enterprise Linux), 9.6 (Rhel Eus), cockpit (debian) and 17 more products.
- It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Jul 8, 2026. Public exploit code is available.
- EPSS estimates a 9.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including cockpit 0:334.1-3.el10_0, cockpit 0:344-2.el9_7, cockpit 337-1+deb13u1.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
9.2%
Higher than 95.3% of all scored CVEs
Exploited in the wild
Yes
2 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-4631 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials.
The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jul 8, 2026 | n/a | Not reported |
| CIRCL KEV | Jul 8, 2026 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
129 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| 9Enterprise Linux | See advisory | n/a |
| 9.6Rhel Eus | See advisory | n/a |
| cockpitdebian | See advisory | 337-1+deb13u1 |
| cockpit-bridgeoracle | See advisory | 344-3.0.1.el10_1 |
| cockpit-docoracle | See advisory | 344-3.0.1.el10_1 |
Patched Releases
cockpit
0:334.1-3.el10_0, 0:344-2.el9_7, 337-1+deb13u1, 344-2.0.1.el9_7, 344-2.el9_7, 344-2.el9_7.rocky.0.1, 344-3.0.1.el10_1, 344-3.el10_1, 344-3.el10_1.rocky.0.1, 354-160000.3.1, 360-1, 360-1.1, 364-160000.1.1
cockpit-bridge
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-devel
354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-doc
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-firewalld
354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-kdump
354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-machines
354-160000.1.1
cockpit-networkmanager
354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-packagekit
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-packages
5-160000.1.1
cockpit-podman
128-160000.1.1
cockpit-repos
4.8-160000.1.1
cockpit-selinux
354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-storaged
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-subscriptions
16.2-160000.1.1
cockpit-system
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-ws
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
cockpit-ws-selinux
344-2.0.1.el9_7, 344-3.0.1.el10_1, 354-160000.3.1, 360-1.1, 364-160000.1.1
Timeline
Publicly disclosed
Apr 7, 2026
Added to Industry KEV feed
Jul 8, 2026
Added to CIRCL KEV
Jul 8, 2026
Last updated
Oct 15, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryRHSA-2026:7381
- advisoryRHSA-2026:7382
- advisoryRHSA-2026:7383
- advisoryRHSA-2026:7384
- advisorygithub.com · 23105
FAQ
Common Questions.
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization.
Affected: 9 (Enterprise Linux); 9.6 (Rhel Eus); cockpit (debian), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since Jul 8, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including cockpit 0:334.1-3.el10_0, cockpit 0:344-2.el9_7, cockpit 337-1+deb13u1.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-4631 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo