{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-91151","cwes":["CWE-59"],"description":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.3,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794426374718,"publishedAt":1794426374718,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"remediation":[],"revision":"3552a17d2c3fbc63b68f05ba9af97f3e3f29167c3f25add74846008dd2bcf4cc","sources":[{"modifiedAt":1794426374718,"name":"CNA: redhat","retrievedAt":1794427777879,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91151"}],"ssvc":null,"status":"published","title":"Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper","updatedAt":1794427777879}