PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4631 Red Hat CVE debrief

CVE-2026-4631 is a critical vulnerability in Cockpit's remote login feature. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. This vulnerability has a CVSS score of 9.8 and is considered CRITICAL. The CVE was published on April 7, 2026, and modified on June 27, 2026.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-15
Advisory published
2026-04-07
Advisory updated
2026-07-15

Who should care

System administrators and security teams responsible for Cockpit installations should be aware of this vulnerability. Given the critical nature of this vulnerability, immediate attention is required to assess and mitigate potential risks. Red Hat products may be affected, as suggested by the presence of Red Hat errata references.

Technical summary

The vulnerability exists in Cockpit's remote login feature, where user-supplied hostnames and usernames are passed to the SSH client without validation or sanitization. This allows attackers to inject malicious SSH options or shell commands. The exploitation occurs during the authentication flow, before any credential verification, and does not require valid login credentials. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating a critical severity level. The vulnerability is categorized under CWE-78.

Defensive priority

High priority should be given to patching or mitigating this vulnerability due to its critical severity and potential for remote code execution. System administrators should review and apply patches or updates provided by the vendor as soon as possible.

Recommended defensive actions

  • Review and apply patches or updates provided by the vendor.
  • Implement additional security measures such as network access controls and monitoring.
  • Conduct a thorough review of system configurations and logs to detect potential exploitation attempts.
  • Consider implementing compensating controls such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
  • Ensure that all system administrators and security teams are aware of this vulnerability and its potential impact.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Red Hat errata references (RHSA-2026:7381, RHSA-2026:7382, RHSA-2026:7383, RHSA-2026:7384) and a Bugzilla entry (2450246) offer additional context and potential mitigations. An OSS-Security mailing list post on April 10, 2026, may also provide relevant discussion and insights.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4631 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4631

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4631 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4631

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.