CVE-2026-4802 Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
Remote attackers can execute arbitrary shell commands on the host by injecting metacharacters into system logs UI links, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-4802?
CVE-2026-4802 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 11 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.
Weakness: CWE-78
Which versions are affected by CVE-2026-4802?
Linux distribution packages (40)
cockpit AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-bridge AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-doc AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-packagekit AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-storaged AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-system AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-ws AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit-ws-selinux AlmaLinux:10 | All versions | 356.2-1.el10_2 |
cockpit AlmaLinux:8 | All versions | 310.8-1.el8_10 |
cockpit-bridge AlmaLinux:8 | All versions | 310.8-1.el8_10 |
cockpit-doc AlmaLinux:8 | All versions | 310.8-1.el8_10 |
cockpit-system AlmaLinux:8 | All versions | 310.8-1.el8_10 |
cockpit-ws AlmaLinux:8 | All versions | 310.8-1.el8_10 |
cockpit AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-bridge AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-doc AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-packagekit AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-storaged AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-system AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-ws AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit-ws-selinux AlmaLinux:9 | All versions | 356.2-1.el9_8 |
cockpit Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-bridge Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-doc Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-packagekit Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-storaged Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-system Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-ws Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit-ws-selinux Red Hat:enterprise_linux:10.2 | All versions | 0:356.2-1.el10_2 |
cockpit Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-bridge Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-doc Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-system Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-ws Red Hat:enterprise_linux:8::baseos | All versions | 0:310.8-1.el8_10 |
cockpit-packagekit Red Hat:enterprise_linux:9::appstream | All versions | 0:356.2-1.el9_8 |
cockpit-storaged Red Hat:enterprise_linux:9::appstream | All versions | 0:356.2-1.el9_8 |
How do I fix CVE-2026-4802?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-4802 being exploited?
There is no known exploitation of CVE-2026-4802 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:21468, ALSA-2026:21676, ALSA-2026:21700, CLSA-2026-1780323631, DEBIAN-CVE-2026-4802, GHSA-3wjm-5g86-c6p3 and 17 more.