CVE-2026-4631

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Two configuration factors determine whether a Cockpit installation is vulnerable to remote code execution.

First, the hostname injection attack (injecting SSH options like -oProxyCommand via the URL path) is blocked by OpenSSH 9.6 and later, which validates hostnames and rejects shell metacharacters before establishing a connection. Systems running Cockpit 327 or later with an OpenSSH version older than 9.6 are vulnerable to unauthenticated remote code execution in the default configuration. Systems with OpenSSH 9.6 or later are not vulnerable to this attack path.

Second, the username injection attack (injecting shell commands via the SSH username) requires that the system's SSH configuration uses the %r (remote username) token within a Match exec directive. This is not part of any default OpenSSH configuration. Systems that do not use %r in a Match exec directive are not vulnerable to this attack path, regardless of OpenSSH version.

Both attack paths require network access to the Cockpit web service (port 9090 by default) and that remote host login is enabled, which is the default Cockpit configuration.

This security issue was introduced in Cockpit version 327. Due to that, the cockpit packages as shipped with Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9 before release 9.6, were not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.