CVE-2026-92747: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-92747 is a sensitive data exposure vulnerability in cockpit-machines (CWE-214: Invocation of Process Using Visible Sensitive Information) that allows a local attacker with process inspection capabilities to read guest virtual machine credentials — specifically rootPassword and userPassword — in cleartext. The flaw exists because the install_machine.py script receives these credentials as a JSON-serialized command-line argument, making them visible in the process list during the VM creation or installation workflow. The vulnerability was reported on 2026-05-11 and publicly disclosed on 2026-09-18, affecting cockpit-machines-348-1.el10 on Red Hat Enterprise Linux. It carries a CVSS v3.1 base score of 5.0 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-214 — credentials are passed insecurely via process arguments rather than through a protected channel such as stdin or a restricted temporary file. In src/libvirtApi/domain.ts, the domainCreate and domainInstall functions serialize a full JSON payload (including rootPassword and userPassword) and pass it as the first positional argument to install_machine.py via python.spawn(installVmScript, [JSON.stringify(args)], ...). The Python script then deserializes it directly with args = json.loads(sys.argv[1], strict=False), making the credentials readable from /proc/<pid>/cmdline or ps output by any local user with sufficient process-visibility permissions. Exploitation requires local host access, a concurrent VM create/install operation with password fields populated, and host process-visibility policies that permit cross-process inspection (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in disclosure of guest VM credentials (rootPassword, userPassword) in plaintext to any local user capable of inspecting running processes. The impact is limited to confidentiality — there is no direct integrity or availability impact. Exposed credentials could be leveraged to authenticate to the guest VM, potentially enabling lateral movement within the virtualized environment or further privilege escalation depending on the role of the compromised guest (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept exploit (in the form of detailed reproduction steps) is publicly available via the Red Hat Bugzilla report. The NVD SSVC assessment classifies exploitation status as "poc" with partial technical impact and non-automatable attack conditions. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting low current exploitation probability (Red Hat Bugzilla, GitHub Advisory).

1. Prerequisite: Obtain local access to a host running cockpit-machines with low-privilege credentials sufficient to inspect running processes.
2. Trigger the vulnerable workflow: Wait for or observe a legitimate user initiating a VM creation or installation through the cockpit-machines UI with rootPassword and/or userPassword fields populated.
3. Identify the target process: While install_machine.py is still running (during the installation window), enumerate processes to locate it: ps -ef | grep install_machine.py
4. Extract the command-line arguments: Read the full command line of the identified process using the /proc filesystem: tr '\0' ' ' < /proc/<pid>/cmdline
5. Parse credentials: The output will contain the JSON payload passed as argv[1], which includes rootPassword and/or userPassword in plaintext. Parse the JSON to extract the credential values.
6. Use credentials: Authenticate to the guest VM using the extracted credentials for lateral movement or further access (Red Hat Bugzilla).

• Process: Unexpected or unauthorized execution of ps -ef | grep install_machine.py or similar process enumeration commands by non-administrative local users during VM installation windows.
• File System / Proc: Unusual access to /proc/<pid>/cmdline for install_machine.py processes from accounts other than the cockpit service account or the initiating user; audit logs showing reads of /proc entries for Python processes.
• Logs: System audit logs (auditd) recording open or read syscalls on /proc/<pid>/cmdline for install_machine.py PIDs by unexpected UIDs; shell history entries containing tr '\0' ' ' < /proc/ patterns.
• Network: Post-exploitation indicator — unexpected SSH or authentication attempts to guest VMs from the host or other internal systems using credentials that match those set during a recent cockpit-machines installation workflow (Red Hat Bugzilla).

A patch has been proposed that modifies install_machine.py to read the JSON payload from stdin instead of argv[1], and updates both domainCreate and domainInstall in src/libvirtApi/domain.ts to pass credentials via p.input() rather than as a command-line argument; users should upgrade to a patched version of cockpit-machines once released. As an interim workaround, restrict process visibility on the host by hardening /proc access (e.g., using hidepid=2 mount option on the /proc filesystem) to prevent local users from inspecting other users' process arguments. Additionally, avoid using password-bearing VM installation workflows when alternative provisioning methods are available (Red Hat Bugzilla, Red Hat CVE).

Red Hat acknowledged the vulnerability was discovered by "AISLE" (Aisle Research) in partnership with Red Hat, and published an advisory noting the flaw leads to sensitive data exposure of guest VM credentials under specific local conditions. The Red Hat advisory characterizes the impact as Moderate, consistent with the local-access requirement and time-limited exposure window. No significant broader media coverage or notable researcher commentary beyond the official Red Hat and GitHub advisory channels has been identified at this time (Red Hat CVE, Red Hat Bugzilla).