CVE-2026-92768 Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
Local attackers can expose sensitive VM credentials by inspecting process command-line arguments during VM creation in Cockpit-machines.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92768?
CVE-2026-92768 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
Weakness: CWE-214
Which versions are affected by CVE-2026-92768?
How do I fix CVE-2026-92768?
Apply the vendor's patch.
Is CVE-2026-92768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92768 exists.
Sources
Also known as DEBIAN-CVE-2026-92768, GHSA-227r-2gp9-9mw3, UBUNTU-CVE-2026-92768.