CVE-2026-91202 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Red Hat Enterprise Linux 9 and 10 systems, especially those with low-privileged user access to the cockpit-files interface, should assess exposure and prioritize mitigation.

Why it matters

Defenders should care about CVE-2026-91202 because it allows low-privileged users to compromise data integrity and potentially reduce confidentiality through arbitrary file ownership changes in Red Hat Enterprise Linux 9 and 10 systems. Verification of affected versions, application of patches, and monitoring for suspicious activity are crucial.

• Data integrity compromise through arbitrary file ownership changes.
• Potential reduction in confidentiality if new ownership grants unauthorized read access.
• Verification of affected versions and application of vendor-provided patches is necessary.
• Monitoring for suspicious activity related to file ownership changes is recommended.

Technical summary

The vulnerability in cockpit-files allows a low-privileged local user to exploit the 'Paste as owner' function by crafting a directory with a symbolic link, leading to arbitrary file ownership changes. This can compromise data integrity and potentially reduce confidentiality if the new ownership grants unauthorized read access. The vulnerability is particularly relevant in Red Hat Enterprise Linux 9 and 10 systems, where low-privileged users have access to the cockpit-files interface. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where data integrity and confidentiality are critical.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in Red Hat Enterprise Linux 9 and 10 systems, especially where low-privileged users have access to the cockpit-files interface.

Recommended defensive actions

• Verify and apply the vendor-provided patches for Red Hat Enterprise Linux 9 and 10.
• Restrict access to the cockpit-files interface to authorized users.
• Monitor systems for suspicious activity related to file ownership changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected products. However, specific version information and remediation steps are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.