Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package cockpit-packagekit  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
15.48% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-COCKPITPACKAGEKIT-15968510
  • published10 Apr 2026
  • disclosed7 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 7 Apr 2026

CVE-2026-4631  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit-packagekit package and not the cockpit-packagekit package as distributed by RHEL.

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.