Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-134819a61b advisory.

    - ws: be more explicit when handling hostnames on cli [CVE-2026-4631]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-473:03 advisory.

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7384 advisory.

    [344-2.0.1]
    - Storage: Enable btrfs support [Orabug: 37464632]
    - Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
    - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
    - Remove duplicate reference to server in cockpit [Orabug: 34030494]
    - Update documentation links [Orabug: 30271413], [Orabug: 32013095],       [Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
    - Update spec file for new release

    [344]
    - Remove recommends on subscription-manager-cockpit if applicable

    * Fri Mar 27 2026 Jelle van der Waa <jvanderw@redhat.com - 344-2
    - ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7383 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ea792bf240 advisory.

    Automatic update for cockpit-360.1-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Tue Apr 14 2026 Packit <hello@packit.dev> - 360.1-1
    - Prevent overmounting also for btrfs subvolumes (https://bugzilla.redhat.com/show_bug.cgi?id=2455855)
    - Remove Mount action in Anaconda mode (https://bugzilla.redhat.com/show_bug.cgi?id=2455855)

    * Wed Apr 08 2026 Packit <hello@packit.dev> - 360-1
    - ws: be more explicit when handling hostnames on cli [CVE-2026-4631]
    - ws: support loading a custom login page
    - Translation updates

    ```



    ----

    Automatic update for cockpit-360-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Wed Apr 08 2026 Packit <hello@packit.dev> - 360-1
    - ws: be more explicit when handling hostnames on cli [CVE-2026-4631]
    - ws: support loading a custom login page
    - Translation updates

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7384 advisory.

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:7383 advisory.

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7383 advisory.

    - correctly apply CVE patches (CVE-2026-4631)

    * Wed Mar 25 2026 Jelle van der Waa <jvanderw@redhat.com - 344-3

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7381 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7382 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7384 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-42f1aaa820 advisory.

    Automatic update for cockpit-360-1.fc43.

    ##### **Changelog for cockpit**

    ```
    * Wed Apr 08 2026 Packit <hello@packit.dev> - 360-1
    - ws: be more explicit when handling hostnames on cli [CVE-2026-4631]
    - ws: support loading a custom login page
    - Translation updates

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the     SSH client without validation or sanitization. An attacker with network access to the Cockpit web service     can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell     commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs     during the authentication flow before any credential verification takes place, meaning no login is     required to exploit the vulnerability. (CVE-2026-4631)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310704	Fedora 42 : cockpit (2026-134819a61b)	Nessus	Fedora Local Security Checks	critical
307681	MiracleLinux 9 : cockpit-344-2.el9_7.ML.1 (AXSA:2026-473:03)	Nessus	Miracle Linux Local Security Checks	critical
307039	Oracle Linux 9 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7384)	Nessus	Oracle Linux Local Security Checks	critical
307025	RHEL 10 : cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Critical) (RHSA-2026:7383)	Nessus	Red Hat Local Security Checks	critical
306849	Fedora 44 : cockpit (2026-ea792bf240)	Nessus	Fedora Local Security Checks	critical
306662	AlmaLinux 9 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7384)	Nessus	Alma Linux Local Security Checks	critical
306521	AlmaLinux 10 : cockpitUnauthenticated remote code execution due to SSH command-line argument injection (Critical) (ALSA-2026:7383)	Nessus	Alma Linux Local Security Checks	critical
306427	Oracle Linux 10 : cockpit: / Unauthenticated / remote / code / execution / due / to / SSH / command-line / argument / injection / (CRITICAL) (ELSA-2026-7383)	Nessus	Oracle Linux Local Security Checks	critical
305958	RHEL 10 : cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Critical) (RHSA-2026:7381)	Nessus	Red Hat Local Security Checks	critical
305957	RHEL 9 : cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Critical) (RHSA-2026:7382)	Nessus	Red Hat Local Security Checks	critical
305956	RHEL 9 : cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Critical) (RHSA-2026:7384)	Nessus	Red Hat Local Security Checks	critical
305806	Fedora 43 : cockpit (2026-42f1aaa820)	Nessus	Fedora Local Security Checks	critical
305219	Linux Distros Unpatched Vulnerability : CVE-2026-4631	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-4631

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical