A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:94485 advisory.

    * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash     (CVE-2026-91147)
      * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in     send_login_html (CVE-2026-76235)


    Bug Fix(es) and Enhancement(s):

      * [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94533 advisory.

    * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash     (CVE-2026-91147)

    * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)

    * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in     send_login_html (CVE-2026-76235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:94485 advisory.

    * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash     (CVE-2026-91147)

    * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in     send_login_html (CVE-2026-76235)

    Bug Fix(es) and Enhancement(s):

    * [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:Rocky Linux-246964)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94533 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash     (CVE-2026-91147)

    * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149)

    * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in     send_login_html (CVE-2026-76235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94533 advisory.

    - ws: Free language string also when it comes from the cookie (RHEL-244637) [CVE-2026-76235]
    - ws: don't crash when urlroot has no trailing slash (RHEL-262905) [CVE-2026-91147]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-94485 advisory.

    - ws: don't crash when urlroot has no trailing slash (RHEL-262904) [CVE-2026-91147]
    - ws: Free language string also when it comes from the cookie (RHEL-244631) [CVE-2026-76235]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94485 advisory.

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network     configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line     sessions, and more.

    Security Fix(es):

    * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash     (CVE-2026-91147)

    * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in     send_login_html (CVE-2026-76235)

    Bug Fix(es) and Enhancement(s):

    * [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61b2a3477a advisory.

    Automatic update for cockpit-368-1.fc44.

    ##### **Changelog for cockpit**

    ```
    * Wed Sep 23 2026 Packit <hello@packit.dev> - 368-1
    - Limit concurrent connections CVE-2026-91149
    - Harden cockpit-ws against trailing slash CVE-2026-91147
    - Sanitize URLs from PackageKit CVE-2026-91148
    - Interactive file chooser for SSH keys
    - Bug fixes and translation updates
    - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for rhel-10.4
    - Resolves RHEL-263066 for rhel-9.10

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the cockpit-368-1.el9 build changelog.

  - A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by     initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the     service to create an unbounded number of detached threads, consuming system resources such as memory and     file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete     unavailability of the Cockpit service for legitimate users. (CVE-2026-91149)

  - Automatic update for cockpit-368-1.fc45.  ##### **Changelog for cockpit**  ``` * Wed Sep 23 2026 Packit     <hello@packit.dev> - 368-1 - Limit concurrent connections CVE-2026-91149 - Harden cockpit-ws against     trailing slash CVE-2026-91147 - Sanitize URLs from PackageKit CVE-2026-91148 - Interactive file chooser     for SSH keys - Bug fixes and translation updates - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for     rhel-10.4 - Resolves RHEL-263066 for rhel-9.10  ```  (CVE-2026-91148)

  - A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a     Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is     configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can     terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
    (CVE-2026-91147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d375ea9e79 advisory.

    Automatic update for cockpit-368-1.fc45.

    ##### **Changelog for cockpit**

    ```
    * Wed Sep 23 2026 Packit <hello@packit.dev> - 368-1
    - Limit concurrent connections CVE-2026-91149
    - Harden cockpit-ws against trailing slash CVE-2026-91147
    - Sanitize URLs from PackageKit CVE-2026-91148
    - Interactive file chooser for SSH keys
    - Bug fixes and translation updates
    - Resolves RHEL-263070, RHEL-262891, RHEL-253609 for rhel-10.4
    - Resolves RHEL-263066 for rhel-9.10

    ```


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a     Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is     configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can     terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
    (CVE-2026-91147)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375859	AlmaLinux 8 : cockpit (ALSA-2026:94485)	Nessus	Alma Linux Local Security Checks	Local	high
375853	RockyLinux 9 : cockpit (RLSA-2026:94533)	Nessus	Rocky Linux Local Security Checks	Local	high
375851	RockyLinux 8 : cockpit (RLSA-2026:94485)	Nessus	Rocky Linux Local Security Checks	Local	high
375678	RHEL 9 : cockpit (RHSA-2026:94533)	Nessus	Red Hat Local Security Checks	Local	high
375664	Oracle Linux 9 : cockpit (ELSA-2026-94533)	Nessus	Oracle Linux Local Security Checks	Local	high
375659	Oracle Linux 8 : cockpit (ELSA-2026-94485)	Nessus	Oracle Linux Local Security Checks	Local	high
375546	RHEL 8 : cockpit (RHSA-2026:94485)	Nessus	Red Hat Local Security Checks	Local	high
363798	Fedora 44 : cockpit (2026-61b2a3477a)	Nessus	Fedora Local Security Checks	Local	high
363460	CentOS 9 : cockpit-368-1.el9	Nessus	CentOS Local Security Checks	Local	high
349923	Fedora 45 : cockpit (2026-d375ea9e79)	Nessus	Fedora Local Security Checks	Local	high
348262	Linux Distros Unpatched Vulnerability : CVE-2026-91147	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-91147

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

medium