CVE-2026-92747 Red Hat CVE debrief

Who should care

Red Hat Enterprise Linux 9 and 10 users and administrators, especially those with `cockpit-machines` installed, should assess exposure and apply vendor advisories. Security teams should verify process visibility policies and restrict access to `install_machine.py`. Operators and platform administrators should prioritize remediation efforts based on asset inventory and potential impact.

Why it matters

CVE-2026-92747 allows local attackers to expose sensitive guest VM credentials in `cockpit-machines`. Defenders should assess exposure, verify process visibility policies, and apply vendor advisories.

• Local attackers can expose sensitive guest VM credentials
• Exposure is limited to the installation workflow
• Defenders should verify process visibility policies
• Remediation requires applying vendor advisories

Technical summary

The `cockpit-machines` package passes sensitive guest VM credentials as JSON command-line arguments during VM creation or installation. Local attackers with process visibility can expose these credentials by inspecting running processes. The vulnerability is limited to the installation workflow and depends on host process-visibility policies. Defenders should focus on restricting access to `install_machine.py` and verifying process visibility policies to mitigate exposure. Red Hat Enterprise Linux 9 and 10 users should prioritize applying vendor advisories.

Defensive priority

Assess exposure in Red Hat Enterprise Linux 9 and 10 deployments using `cockpit-machines`. Verify process visibility policies and restrict access to `install_machine.py`.

Recommended defensive actions

• Review and restrict access to `install_machine.py`
• Verify process visibility policies
• Assess exposure in Red Hat Enterprise Linux 9 and 10 deployments
• Apply vendor advisories RHSA-2026:86970 and RHSA-2026:86971
• Monitor for suspicious activity related to `cockpit-machines`
• Inventory affected systems for prioritized remediation
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has released advisories RHSA-2026:86970 and RHSA-2026:86971. Bugzilla issue RHBZ#2469260 tracks the vulnerability. The issue was reported by a security researcher and verified through controlled experiments. The CVE Program and NVD provide additional context on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.