CVE-2026-4631: Cockpit Remote Login RCE Vulnerability

CVE-2026-4631 Overview

CVE-2026-4631 is a critical command injection vulnerability in Cockpit's remote login feature. The vulnerability allows an attacker with network access to the Cockpit web service to craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs because user-supplied hostnames and usernames from the web interface are passed to the SSH client without validation or sanitization.

Critical Impact

This pre-authentication command injection vulnerability enables remote code execution on affected Cockpit servers without requiring any valid credentials, as the injection occurs during the authentication flow before credential verification takes place.

Affected Products

• Cockpit Web Console (versions with remote login feature enabled)
• Red Hat Enterprise Linux systems running vulnerable Cockpit versions
• Linux distributions bundling affected Cockpit packages

Discovery Timeline

• April 7, 2026 - CVE-2026-4631 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4631

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists in Cockpit's remote login functionality, which is designed to allow administrators to connect to remote systems via SSH through the web interface.

The core issue stems from insufficient input validation on user-controlled parameters. When a user attempts to authenticate to a remote host through Cockpit's web interface, the hostname and username fields are directly incorporated into SSH command construction without proper sanitization. This allows an attacker to inject arbitrary SSH options or shell metacharacters that are then executed in the context of the Cockpit service.

What makes this vulnerability particularly severe is its pre-authentication nature. The command injection occurs during the authentication flow before any credential verification takes place. This means an attacker only needs network access to the Cockpit web service—typically running on port 9090—to exploit this vulnerability and gain code execution on the host system.

Root Cause

The root cause is the lack of validation or sanitization of user-supplied hostnames and usernames before passing them to the SSH client. The remote login feature directly incorporates these untrusted inputs into shell commands or SSH command-line arguments, allowing injection of arbitrary commands or SSH options.

Attack Vector

The attack is conducted over the network by sending a specially crafted HTTP request to Cockpit's login endpoint. An attacker can inject malicious content through the hostname or username parameters in the authentication request. Since Cockpit is a web-based administration tool typically exposed on port 9090, any attacker with network access to this service can attempt exploitation.

The attack flow involves:

1. An attacker identifies a Cockpit instance with remote login enabled
2. The attacker crafts an HTTP request to the login endpoint with malicious SSH options or shell metacharacters embedded in the hostname or username field
3. Cockpit processes the request and passes the unsanitized input to the SSH client
4. The injected commands execute on the Cockpit host with the privileges of the Cockpit service

Additional technical details are available in the Red Hat CVE-2026-4631 Advisory and Red Hat Bug Report #2450246.

Detection Methods for CVE-2026-4631

Indicators of Compromise

• Unusual HTTP requests to the Cockpit login endpoint (/cockpit/login) containing special characters, SSH options (e.g., -o ProxyCommand), or shell metacharacters in hostname/username fields
• Unexpected SSH processes spawned by the Cockpit service with unusual command-line arguments
• Anomalous process execution chains originating from cockpit-ws or cockpit-session processes
• Web server logs showing authentication attempts with malformed or suspicious hostname/username values

Detection Strategies

• Monitor Cockpit web server access logs for login requests containing shell metacharacters (;, |, $(), backticks) or SSH option flags (-o, -J, -F) in hostname or username parameters
• Implement intrusion detection rules to alert on malformed HTTP POST requests to Cockpit authentication endpoints
• Deploy endpoint detection to identify anomalous child processes spawned by Cockpit service components
• Use SentinelOne Singularity to detect and prevent suspicious command execution patterns originating from web service processes

Monitoring Recommendations

• Enable verbose logging for Cockpit services to capture authentication attempt details
• Implement network monitoring for connections to Cockpit port 9090 from untrusted sources
• Configure alerts for any SSH commands executed with unusual options or to unexpected destinations from the Cockpit server
• Review process execution telemetry for command injection patterns following Cockpit service activity

How to Mitigate CVE-2026-4631

Immediate Actions Required

• Apply security patches from your distribution vendor as soon as they become available
• If remote login functionality is not required, disable it by configuring LoginTo = false in Cockpit's cockpit.conf configuration file
• Restrict network access to Cockpit (port 9090) to trusted management networks only using firewall rules
• Consider temporarily disabling Cockpit entirely on internet-facing systems until patches are applied

Patch Information

Red Hat has acknowledged this vulnerability and is tracking it under Bug Report #2450246. Organizations should monitor the Red Hat CVE-2026-4631 Advisory for patch availability and apply updates as they are released for their specific distribution and version.

Workarounds

• Disable the remote login feature in Cockpit by setting LoginTo = false in /etc/cockpit/cockpit.conf
• Use firewall rules to restrict access to Cockpit's web interface (port 9090) from untrusted networks
• Deploy a reverse proxy with additional input validation in front of Cockpit to filter malicious requests
• Consider using alternative management tools until patches are available and deployed

# Disable Cockpit remote login feature
sudo mkdir -p /etc/cockpit
echo "[Session]
LoginTo = false" | sudo tee /etc/cockpit/cockpit.conf

# Restart Cockpit to apply changes
sudo systemctl restart cockpit

# Restrict Cockpit access via firewall (example using firewalld)
sudo firewall-cmd --zone=public --remove-service=cockpit --permanent
sudo firewall-cmd --zone=trusted --add-service=cockpit --permanent
sudo firewall-cmd --reload