CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

This Moderate availability flaw in cockpit-ws can lead to a denial of service. Exploitation requires a non-default [WebService] UrlRoot configuration and an unauthenticated request to the exact configured URL-root prefix without a trailing slash, which must reach cockpit-ws without front-end normalization or redirection. This makes the vulnerability less easily exploitable in typical Red Hat deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A code fix is being pursued for the affected streams. Until updated packages are available, avoid configuring a non-empty [WebService] UrlRoot in cockpit-ws where feasible. If a non-empty UrlRoot is required, configure the front-end proxy or TLS terminator in front of cockpit-ws to rewrite or redirect requests for the exact configured prefix (for example, /cockpit) to the trailing-slash form (for example, /cockpit/) before forwarding them, so the exact-prefix request never reaches cockpit-ws unnormalized. Deployments whose front end already normalizes or redirects such requests are not exposed through that route.