CVE-2026-92747 Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
Local attackers can expose sensitive VM credentials by inspecting process lists during installation, requiring a patch to Cockpit-machines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-92747?
CVE-2026-92747 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 18 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
Weakness: CWE-214
Which versions are affected by CVE-2026-92747?
How do I fix CVE-2026-92747?
Apply the vendor's patch.
Is CVE-2026-92747 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92747 exists.
Sources
Also known as DEBIAN-CVE-2026-92747, GHSA-8p9r-6652-9xc4, UBUNTU-CVE-2026-92747.