CVE-2026-92747

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as rootPassword and userPassword. This occurs when the install_machine.py script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.

This flaw in cockpit-machines can lead to sensitive data exposure of guest VM credentials. When creating or installing a VM with password fields populated, install_machine.py passes these credentials as a JSON command-line argument. This makes them visible to other local users on the host who can inspect running processes, but only while the installation workflow is active and if host process-visibility policies permit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Exposure can be reduced by avoiding VM creation or installation flows that supply rootPassword or userPassword while untrusted local users are active on the host, and by using an alternative provisioning method where one is available. Restricting cross-user process inspection on the host, for example by hardening /proc visibility with the hidepid mount option, also limits the ability of other local users to read the install_machine.py command line. These measures reduce the exposure window but do not remove the underlying issue of credentials being passed in process arguments; they should be treated as temporary risk reduction until a fixed cockpit-machines package is available.