A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21208-1 advisory.

    This update for cockpit fixes the following issue

    - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links     in system logs       UI (bsc#1265040).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-21468 advisory.

    [356.2-1.0.1]
    - Apply the patch for duplicate reference [Orabug: 39250109]
    - Storage: Enable btrfs support [Orabug: 37464632]
    - Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
    - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
    - Remove duplicate reference to server in cockpit [Orabug: 34030494]
    - Update documentation links [Orabug: 30271413], [Orabug: 32013095],       [Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
    - Update spec file for new release

    [356.2]
    - Remove recommends on subscription-manager-cockpit if applicable

    [356.1-1]
    - ws: Prevent remote code execution with SSH argument injection (RHEL-158310)
    - node: update lodash dependency (RHEL-164196)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-58cee40a55 advisory.

    Automatic update for cockpit-362-1.fc43.

    ##### **Changelog for cockpit**

    ```
    * Wed May 20 2026 Packit <hello@packit.dev> - 362-1
    - Bug fixes and translation updates
    - Fix arbitrary code execution via specially crafted logs page link (CVE-2026-4802)

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21676 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-750:04 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:21676 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21468 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:21700 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs     UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:21700 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs


    UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21392 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21676 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21700 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It     offers network configuration, log inspection, diagnostic reports, SELinux     troubleshooting, interactive command-line sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs     UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:21468 advisory.

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-21700 advisory.

    - pkg/systemd: robustify argument quoting [CVE-2026-4802] (RHEL-161386)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21516 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21395 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21647 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21468 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21515 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21394 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:21390 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ac9d9c87c8 advisory.

    Automatic update for cockpit-362-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Wed May 20 2026 Packit <hello@packit.dev> - 362-1
    - Bug fixes and translation updates
    - Fix arbitrary code execution via specially crafted logs page link (CVE-2026-4802)

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command     execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the     system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions     into these parameters, leading to the execution of arbitrary shell commands on the affected system. This     could result in a complete system compromise. (CVE-2026-4802)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325037	openSUSE 16: cockpit / cockpit-bridge / cockpit-devel / cockpit-firewalld / etc (openSUSE-SU-2026:21208-1)	Nessus	SuSE Local Security Checks	high
322558	Oracle Linux 9 : cockpit (ELSA-2026-21468)	Nessus	Oracle Linux Local Security Checks	high
318776	Fedora 43 : cockpit (2026-58cee40a55)	Nessus	Fedora Local Security Checks	high
318657	RockyLinux 10 : cockpit (RLSA-2026:21676)	Nessus	Rocky Linux Local Security Checks	high
318369	MiracleLinux 8 : cockpit-310.8-1.el8_10.ML.1 (AXSA:2026-750:04)	Nessus	Miracle Linux Local Security Checks	high
318317	AlmaLinux 10 : cockpit (ALSA-2026:21676)	Nessus	Alma Linux Local Security Checks	high
318041	RockyLinux 9 : cockpit (RLSA-2026:21468)	Nessus	Rocky Linux Local Security Checks	high
317745	RockyLinux 8 : cockpit (RLSA-2026:21700)	Nessus	Rocky Linux Local Security Checks	high
317528	AlmaLinux 8 : cockpit (ALSA-2026:21700)	Nessus	Alma Linux Local Security Checks	high
317508	RHEL 9 : cockpit (RHSA-2026:21392)	Nessus	Red Hat Local Security Checks	high
317463	RHEL 10 : cockpit (RHSA-2026:21676)	Nessus	Red Hat Local Security Checks	high
317457	RHEL 8 : cockpit (RHSA-2026:21700)	Nessus	Red Hat Local Security Checks	high
317456	AlmaLinux 9 : cockpit (ALSA-2026:21468)	Nessus	Alma Linux Local Security Checks	high
317448	Oracle Linux 8 : cockpit (ELSA-2026-21700)	Nessus	Oracle Linux Local Security Checks	high
317377	RHEL 8 : cockpit (RHSA-2026:21516)	Nessus	Red Hat Local Security Checks	high
317376	RHEL 9 : cockpit (RHSA-2026:21395)	Nessus	Red Hat Local Security Checks	high
317373	RHEL 9 : cockpit (RHSA-2026:21647)	Nessus	Red Hat Local Security Checks	high
317335	RHEL 9 : cockpit (RHSA-2026:21468)	Nessus	Red Hat Local Security Checks	high
317333	RHEL 8 : cockpit (RHSA-2026:21515)	Nessus	Red Hat Local Security Checks	high
317106	RHEL 9 : cockpit (RHSA-2026:21394)	Nessus	Red Hat Local Security Checks	high
317100	RHEL 10 : cockpit (RHSA-2026:21390)	Nessus	Red Hat Local Security Checks	high
316474	Fedora 44 : cockpit (2026-ac9d9c87c8)	Nessus	Fedora Local Security Checks	high
314191	Linux Distros Unpatched Vulnerability : CVE-2026-4802	Nessus	Misc.	high

Detections

Analytics

CVE-2026-4802

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high