rpm package
almalinux/cockpit-machines
pkg:rpm/almalinux/cockpit-machines
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-92768 | Med | 5.5 | < 348.1-1.el9_8 | 348.1-1.el9_8 | Sep 18, 2026 | A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component pa | |
| CVE-2026-92747 | Med | 5.0 | < 348.1-1.el9_8 | 348.1-1.el9_8 | Sep 18, 2026 | A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script | |
| CVE-2026-92745 | Med | 5.0 | < 348.1-1.el9_8 | 348.1-1.el9_8 | Sep 18, 2026 | A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helpe |
- affected < 348.1-1.el9_8fixed 348.1-1.el9_8
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component pa
- affected < 348.1-1.el9_8fixed 348.1-1.el9_8
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script
- affected < 348.1-1.el9_8fixed 348.1-1.el9_8
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helpe