{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92768", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-16T19:08:56.383Z", "datePublished": "2026-09-18T17:53:54.833Z", "dateUpdated": "2026-10-21T13:31:44.314Z"}, "containers": {"cna": {"title": "Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit-machines", "defaultStatus": "affected", "versions": [{"version": "0:348.1-1.el10_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit-machines", "defaultStatus": "affected", "versions": [{"version": "0:348.1-1.el9_8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:86970", "name": "RHSA-2026:86970", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:86971", "name": "RHSA-2026:86971", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-92768", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258", "name": "RHBZ#2469258", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-18T16:36:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-214", "description": "Invocation of Process Using Visible Sensitive Information", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-214: Invocation of Process Using Visible Sensitive Information", "workarounds": [{"lang": "en", "value": "Restrict visibility of process command-line arguments to other local users by mounting /proc with the hidepid=2 option, for example by remounting /proc with 'mount -o remount,hidepid=2 /proc' or configuring 'proc /proc proc defaults,hidepid=2 0 0' in /etc/fstab. This prevents unprivileged local users from reading other users' process arguments. Additionally, on shared hosts where other local users can inspect process arguments, avoid supplying root or user passwords through the Cockpit Machines VM create and install flows, and prefer provisioning methods that do not pass passwords on the command line. Updated cockpit-machines packages that stop passing password material on the command line are being delivered for affected streams; installing the updated package once it is available for your stream resolves this issue."}], "timeline": [{"lang": "en", "time": "2026-05-11T19:59:32.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-18T16:36:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-21T13:31:44.314Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T16:18:50.692537Z", "id": "CVE-2026-92768", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T16:18:56.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92768", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T16:18:50.692537Z"}}}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T16:18:33.541Z"}}], "cna": {"title": "Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments", "credits": [{"lang": "en", "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "cockpit-machines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "cockpit-machines", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-11T19:59:32.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-18T16:36:00.000Z", "value": "Made public."}], "datePublic": "2026-09-18T16:36:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-92768", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258", "name": "RHBZ#2469258", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Restrict visibility of process command-line arguments to other local users by mounting /proc with the hidepid=2 option, for example by remounting /proc with 'mount -o remount,hidepid=2 /proc' or configuring 'proc /proc proc defaults,hidepid=2 0 0' in /etc/fstab. This prevents unprivileged local users from reading other users' process arguments. Additionally, on shared hosts where other local users can inspect process arguments, avoid supplying root or user passwords through the Cockpit Machines VM create and install flows, and prefer provisioning methods that do not pass passwords on the command line. Updated cockpit-machines packages that stop passing password material on the command line are being delivered for affected streams; installing the updated package once it is available for your stream resolves this issue."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-214", "description": "Invocation of Process Using Visible Sensitive Information"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-16T12:19:25.245Z"}, "x_redhatCweChain": "CWE-214: Invocation of Process Using Visible Sensitive Information"}}, "cveMetadata": {"cveId": "CVE-2026-92768", "state": "PUBLISHED", "dateUpdated": "2026-10-16T12:19:25.245Z", "dateReserved": "2026-09-16T19:08:56.383Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-18T17:53:54.833Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "cockpit-machines", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:348.1-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream"], "defaultStatus": "affected", "packageName": "cockpit-machines", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:348.1-1.el9_8", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access."}], "id": "CVE-2026-92768", "lastModified": "2026-10-21T14:17:22.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92768", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T16:18:50.692537Z", "version": "2.0.3"}}]}, "published": "2026-09-18T18:18:17.150", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:86970"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:86971"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-92768"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-214"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments", "id": "2469258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-214", "details": ["A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access."], "name": "CVE-2026-92768", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "cockpit-machines", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "cockpit-machines", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-18T16:36:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92768\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92768"], "statement": "This Moderate impact flaw in `cockpit-machines` allows local attackers to expose sensitive VM credentials. During VM creation or installation, passwords passed via command-line arguments can be read by other local users if `/proc` visibility is not restricted. Exploitation requires local access and a specific execution window, but successful attacks can lead to full credential disclosure.", "threat_severity": "Moderate"}