Introduction
An unauthenticated command injection in Cockpit's remote login feature lets any network attacker execute code on the host with a single HTTP request and no credentials. The vulnerability has a CVSS score of 9.8, and Cockpit is deployed across Fedora, RHEL, CentOS, Debian, Ubuntu, and other major Linux distributions, so the blast radius is broad for organizations that rely on web-based server administration.
Cockpit is a free and open-source, web-based remote administration tool for Linux servers, sponsored by Red Hat. It ships by default, or is readily available in package repositories, for most major enterprise Linux distributions. That makes it one of the more widely deployed server management interfaces in the Linux ecosystem. Because Cockpit is a privileged administration interface, a compromise of Cockpit typically equates to full control of the underlying server.
Technical Information
The root cause of CVE-2026-4631 is an OS command injection (CWE-78) in the authentication pipeline of the Cockpit web service component, cockpit-ws. When a user attempts to log in, cockpit-ws examines the Authorization header on requests to the login endpoint and spawns a session command with the target host as an argument. The remote login feature passes user-supplied hostnames and usernames directly to the SSH client without any validation or sanitization.
Because that input flows into a command execution context, an attacker can embed malicious SSH options or shell metacharacters in the hostname or username fields of the authentication request. The session command is spawned before the Pluggable Authentication Modules (PAM) have completed credential verification, so the injection executes before any authentication check occurs.
Attack Flow
Exploitation takes five steps:
- The attacker identifies a network-accessible Cockpit instance, typically listening on port 9090.
- The attacker crafts a single HTTP request to the login endpoint, embedding a malicious payload in the hostname or username field within the
Authorizationheader. cockpit-wsparses the request and passes the unsanitized input as an argument when spawning the SSH session command.- The injected SSH options or shell commands execute on the Cockpit host with the privileges of the
cockpit-wsprocess. - The entire chain completes before PAM performs any credential verification, so no valid username or password is needed.
The attack vector is the network, the complexity is low, and the attack requires no user interaction or prior privileges. Together, these characteristics produce the CVSS 9.8 base score.
Why This Matters Architecturally
Cockpit's design intentionally delegates authentication to SSH and PAM. The web service is a bridge that receives credentials over HTTPS and relays them to an SSH session on the backend. In this architecture, the hostname and username values are operands in a command that runs on the system, not just metadata. Without input sanitization at that boundary, a login form becomes a command injection surface.
Affected Systems and Versions
The vulnerability affects the Cockpit web service (cockpit-ws) with the remote login feature enabled. At the time of writing, the available advisories have not published specific affected version numbers. The following configurations are known to be vulnerable:
- Cockpit installations where the
LoginToconfiguration option is not explicitly set tofalse(remote login is enabled by default in many deployments) - Cockpit instances accessible over the network (default port 9090)
- Deployments across Fedora Linux, Red Hat Enterprise Linux, CentOS, Debian, OpenSUSE, Arch Linux, and Ubuntu where Cockpit is installed and running
Organizations should watch the Red Hat Bugzilla ticket and the NVD entry for exact version ranges as the vendor publishes more detailed advisories.
Mitigation Strategies
No official patch has been confirmed, so administrators should apply configuration-level controls that neutralize the vulnerable code path:
- Set
LoginTotofalseincockpit.conf. This is the most direct mitigation, because it disables the remote login feature entirely and removes the injection pathway. - Set
AllowMultiHosttofalseincockpit.confto prevent cross-host session connections. - Configure
ListenStreamin the systemd socket drop-in file so thatcockpit-wslistens only on specific trusted IP addresses, rather than on all interfaces. - Use firewalld and SELinux port definitions to restrict inbound traffic on the Cockpit port to trusted networks.
Treat these controls as interim measures, and monitor Red Hat Bugzilla ticket 2450246 for official patch releases.
Vendor Security History
The Cockpit development team has a track record of proactively addressing security concerns in the project's architecture. The team recently decided to deprecate the host switcher feature by default in newer distributions, because of the security risks inherent in cross-host interactions and the limitations of web technology in that context. The decision, documented in the Cockpit 322 release notes, shows a willingness to reduce attack surface when architectural vulnerabilities are identified, even when that means removing user-facing functionality.
