CVE-2026-92745 Red Hat CVE debrief

Who should care

Local system administrators and security teams responsible for Red Hat Enterprise Linux 10 and 9 systems using cockpit-machines should assess exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-92745 allows local attackers to disclose sensitive RHSM offline tokens in cockpit-machines. Defenders should verify patches, restrict process metadata access, and monitor logs. The vulnerability's impact on confidentiality requires immediate attention from system administrators and security teams.

• Local attackers may obtain sensitive RHSM offline tokens.
• Compromise of confidentiality may occur if tokens are used to request access tokens.
• System administrators must verify and apply patches or mitigations.
• Inventory checks are required to identify affected systems.

Technical summary

The cockpit-machines package is vulnerable to information disclosure. A local attacker with access to process metadata can exploit this flaw to obtain a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed as a command-line argument during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens. Defenders should focus on verifying and applying patches, restricting process metadata access, and monitoring logs for potential exploitation attempts.

Defensive priority

Medium priority for local system administrators and security teams to verify and apply patches.

Recommended defensive actions

• Verify and apply patches from Red Hat for cockpit-machines on affected systems.
• Restrict access to process metadata for sensitive systems.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows a local attacker to inspect process metadata and disclose a sensitive RHSM offline token. The token is exposed as a command-line argument during token validation. Defenders should verify patches, restrict process metadata access, and monitor logs for potential exploitation attempts. The source details indicate that the token validation process exposes the sensitive information, and evidence limits suggest that defenders should focus on verifying patches and restricting access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.