# CVE-2026-92768: Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments

Status: published. Published: 2026-09-18. Updated: 2026-11-11.

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.

## Remediation

- workaround: Restrict visibility of process command-line arguments to other local users by mounting /proc with the hidepid=2 option, for example by remounting /proc with 'mount -o remount,hidepid=2 /proc' or configuring 'proc /proc proc defaults,hidepid=2 0 0' in /etc/fstab. This prevents unprivileged local users from reading other users' process arguments. Additionally, on shared hosts where other local users can inspect process arguments, avoid supplying root or user passwords through the Cockpit Machines VM create and install flows, and prefer provisioning methods that do not pass passwords on the command line. Updated cockpit-machines packages that stop passing password material on the command line are being delivered for affected streams; installing the updated package once it is available for your stream resolves this issue. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (cockpit-machines): ≥ 0:348.1-1.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (cockpit-machines): ≥ 0:355.1-1.el10_3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (cockpit-machines): ≥ 0:348.1-1.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (cockpit-machines): ≥ 0:355.1-1.el9_9; < * (unaffected, rpm). Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: redhat

- CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.17% as of 2026-11-10; percentile 5.99%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-214

## Exploit evidence

- exploit: https://bugzilla.redhat.com/show_bug.cgi?id=2469258 (ADP: CISA-ADP)

## References

- https://access.redhat.com/errata/RHSA-2026:86970 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:86971 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:98459 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:98562 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-92768 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 (ADP: CISA-ADP; exploit)

- https://access.redhat.com/errata/RHSA-2026:86970 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:86971 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:98459 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-92768 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2469258 (134c704f-9b21-4f2e-91b3-4a467353bcc0)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-92768; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92768; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-92768; retrieved 2026-11-11; source updated Not reported

Revision: 7c36488cac2fadf33a09d3a624e3c43d1b4747010d0eba2fbdc39986f5778026

Canonical: https://y2.dev/cve/CVE-2026-92768

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.