A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

alma_linux ALSA-2026:21676: ALSA-2026:21676: cockpit security update (High)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21468 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21700 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs     UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:21700 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs


    UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21392 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21676 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21700 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs     UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:21468 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-21700 advisory.

    - pkg/systemd: robustify argument quoting [CVE-2026-4802] (RHEL-161386)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21516 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21395 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21647 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21468 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21515 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21394 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21390 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ac9d9c87c8 advisory.

    Automatic update for cockpit-362-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Wed May 20 2026 Packit <hello@packit.dev> - 362-1
    - Bug fixes and translation updates
    - Fix arbitrary code execution via specially crafted logs page link (CVE-2026-4802)

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command     execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the     system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions     into these parameters, leading to the execution of arbitrary shell commands on the affected system. This     could result in a complete system compromise. (CVE-2026-4802)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318041	RockyLinux 9 : cockpit (RLSA-2026:21468)	Nessus	Rocky Linux Local Security Checks	high
317745	RockyLinux 8 : cockpit (RLSA-2026:21700)	Nessus	Rocky Linux Local Security Checks	high
317528	AlmaLinux 8 : cockpit (ALSA-2026:21700)	Nessus	Alma Linux Local Security Checks	high
317508	RHEL 9 : cockpit (RHSA-2026:21392)	Nessus	Red Hat Local Security Checks	high
317463	RHEL 10 : cockpit (RHSA-2026:21676)	Nessus	Red Hat Local Security Checks	high
317457	RHEL 8 : cockpit (RHSA-2026:21700)	Nessus	Red Hat Local Security Checks	high
317456	AlmaLinux 9 : cockpit (ALSA-2026:21468)	Nessus	Alma Linux Local Security Checks	high
317448	Oracle Linux 8 : cockpit (ELSA-2026-21700)	Nessus	Oracle Linux Local Security Checks	high
317377	RHEL 8 : cockpit (RHSA-2026:21516)	Nessus	Red Hat Local Security Checks	high
317376	RHEL 9 : cockpit (RHSA-2026:21395)	Nessus	Red Hat Local Security Checks	high
317373	RHEL 9 : cockpit (RHSA-2026:21647)	Nessus	Red Hat Local Security Checks	high
317335	RHEL 9 : cockpit (RHSA-2026:21468)	Nessus	Red Hat Local Security Checks	high
317333	RHEL 8 : cockpit (RHSA-2026:21515)	Nessus	Red Hat Local Security Checks	high
317106	RHEL 9 : cockpit (RHSA-2026:21394)	Nessus	Red Hat Local Security Checks	high
317100	RHEL 10 : cockpit (RHSA-2026:21390)	Nessus	Red Hat Local Security Checks	high
316474	Fedora 44 : cockpit (2026-ac9d9c87c8)	Nessus	Fedora Local Security Checks	high
314191	Linux Distros Unpatched Vulnerability : CVE-2026-4802	Nessus	Misc.	high

Detections

Analytics

CVE-2026-4802

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high