CVE-2026-4631: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-4631 is a critical unauthenticated remote code execution (RCE) vulnerability in Cockpit, a web-based Linux server management interface. The flaw exists in Cockpit's remote login feature, which passes user-supplied hostnames and usernames directly to the OpenSSH ssh client without validation or sanitization, enabling OS command injection. Affected versions are Cockpit 327 through 359 (versions that migrated to the python3 -m cockpit.beiboot SSH invocation path); version 360 contains the fix. The vulnerability was reported on March 23, 2026, publicly disclosed on April 7, 2026, and patched on April 10, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Github Advisory).

The root cause is CWE-78 (OS Command Injection): neither cockpit-ws (C code in cockpitauth.c/cockpitauthorize.c) nor cockpit.beiboot (Python code in beiboot.py) validates or sanitizes the username or hostname before passing them as command-line arguments to the ssh process. Two distinct injection paths exist: (1) Username injection — SSH config files using %r token expansion in Match exec directives will execute attacker-controlled shell commands before SSH validates the username (e.g., username x; touch /tmp/flag; # causes arbitrary command execution); (2) Hostname injection — because no -- separator precedes the destination argument in via_ssh(), a hostname beginning with - (e.g., -oProxyCommand=<cmd>) is interpreted as an SSH option, triggering ProxyCommand execution; this path is mitigated on systems running OpenSSH ≥ 9.6, which introduced early hostname validation. Exploitation requires only a single HTTP request to /cockpit+=/login with any Authorization: Basic header — even with invalid credentials — to trigger the vulnerable ssh invocation before authentication completes (Red Hat Bugzilla, oss-security).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the Cockpit host with the privileges of the Cockpit web service process, resulting in complete system compromise — full confidentiality, integrity, and availability impact. An attacker can read sensitive data, modify system files, install backdoors, disrupt services, or use the compromised host as a pivot point for lateral movement within the network. The attack requires only network connectivity to the Cockpit web service and a single crafted HTTP request, with no credentials needed (Red Hat CVE, Github Advisory).

A public proof-of-concept exploit has been published at github.com/cyberheartmi9/CVE-2026-4631-cockpit-RCE, and exploit entries have appeared on Sploitus (referencing Exploit-DB ID 52572 and PacketStorm 221753), indicating weaponized exploit code is publicly available. Nuclei detection templates for this vulnerability have been added to the ProjectDiscovery nuclei-templates repository across multiple commits. The EPSS score from the GitHub Advisory Database is approximately 30.39% (97th percentile), indicating a high probability of exploitation within 30 days. No CISA KEV catalog listing or confirmed in-the-wild exploitation has been reported as of the available data, and no specific threat actor attribution has been made (Github Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing Cockpit instances (default port 9090) running versions 327–359 using tools like Shodan (port:9090 product:Cockpit) or Censys. Confirm the version via the Cockpit web UI or HTTP response headers.
2. Craft the malicious request: Prepare an HTTP POST request to the login endpoint. For hostname injection, craft a URL path such as /cockpit+=-oProxyCommand=<base64-encoded-command>/login. For username injection, set the username field in the Authorization: Basic header to a value like x; <command>; #.
3. Trigger SSH invocation: Send the crafted HTTP request with any Authorization: Basic header (credentials can be invalid). This triggers python3 -m cockpit.beiboot to invoke the ssh client with the attacker-controlled arguments before any credential verification occurs.
4. Achieve code execution: The injected ProxyCommand or shell command embedded in the username is executed by the SSH client on the Cockpit host. For example, a reverse shell payload can be injected to establish a callback to an attacker-controlled listener.
5. Post-exploitation: With code execution achieved as the Cockpit service account, the attacker can escalate privileges, exfiltrate data, install persistence mechanisms, or pivot to other systems on the network (Red Hat Bugzilla, oss-security).

• Network: Unexpected outbound connections from the Cockpit host to external IPs on non-standard ports shortly after HTTP requests to port 9090; HTTP requests to /cockpit+=/login with URL paths containing -o, ProxyCommand, or other SSH option strings; unusual HTTP POST requests to the Cockpit login endpoint with malformed or suspicious Authorization: Basic headers.
• Logs: Cockpit web service logs (/var/log/cockpit/ or journald) showing requests to /cockpit+=/login with hostnames beginning with - or usernames containing shell metacharacters (;, |, &, $); SSH client invocations in process audit logs with unexpected arguments including -oProxyCommand.
• Process: Unexpected child processes spawned by cockpit-ws or python3 (e.g., /bin/bash, curl, wget, nc, python3) visible in process trees via ps or audit logs; ssh processes with unusual command-line arguments in /proc/<pid>/cmdline.
• File System: New or modified files in /tmp/, /var/tmp/, or world-writable directories created by the Cockpit service account; unexpected cron jobs, systemd units, or SSH authorized_keys modifications; web shells or backdoor scripts in Cockpit-accessible directories (Red Hat Bugzilla, oss-security).

The primary remediation is to upgrade Cockpit to version 360 or later, which adds input validation and sanitization for hostnames and usernames before passing them to the SSH client (oss-security). Red Hat has released patched packages: RHSA-2026:7381 for RHEL 10 (cockpit-334.1-3.el10_0) and RHSA-2026:7384 for other RHEL versions; Fedora 43, 44, and rawhide updates are also available (Red Hat RHSA-2026:7381). As an interim workaround, restrict network access to the Cockpit web service (default port 9090) to trusted networks only using firewall rules, and disable the remote SSH login feature in Cockpit configuration if it is not required. Ensure OpenSSH is updated to version 9.6 or later, which provides partial mitigation against the hostname injection vector.

The vulnerability was publicly disclosed via the oss-security mailing list on April 10, 2026, by Cockpit maintainer Jelle van der Waa, who provided detailed technical analysis and coordinated the fix (oss-security). Red Hat rated the issue as Critical severity and issued emergency security advisories for RHEL 10 on the same day as the public disclosure (Red Hat RHSA-2026:7381). Security media outlet SecurityOnline.info covered the vulnerability with an article titled "Cockpit RCE Vulnerability - Linux Security CVE-2026-4631," and the issue received attention on Bluesky from infosec community accounts. The vulnerability was also featured in the "Week in Vulnerabilities" roundup on malware.news, reflecting broad community awareness of its severity.