CVE-2026-91147: Cockpit-ws Denial of Service Vulnerability

CVE-2026-91147 Overview

CVE-2026-91147 is a denial of service vulnerability in cockpit-ws, the web service component of the Cockpit server management interface. A remote, unauthenticated attacker can crash the service by sending a specially crafted HTTP request to the configured WebService.UrlRoot prefix without a trailing slash. The flaw is classified under CWE-617: Reachable Assertion and results in the Cockpit web service terminating unexpectedly. Successful exploitation makes the Cockpit administrative interface unavailable to legitimate users until the service restarts.

Critical Impact
Remote, unauthenticated attackers can terminate the cockpit-ws process and deny administrators access to the Cockpit management interface.

Affected Products

Cockpit Project cockpit-ws component
Red Hat Enterprise Linux distributions shipping Cockpit
Any deployment with WebService.UrlRoot configured in cockpit.conf

Discovery Timeline

2026-09-18 - CVE-2026-91147 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-91147

Vulnerability Analysis

The vulnerability resides in the request handling logic of cockpit-ws when administrators configure a custom URL root through the WebService.UrlRoot setting. When an incoming HTTP request targets the exact URL root prefix without a trailing slash, the service reaches an unhandled condition and terminates. The flaw requires no authentication and no user interaction, exposing any network-reachable Cockpit instance with a configured URL root.

Because cockpit-ws fronts the Cockpit administration console, its termination removes remote administrative access to the affected host. Attackers can repeatedly trigger the crash to sustain the denial of service condition, disrupting monitoring, patching, and incident response activities that rely on Cockpit.

Root Cause

The root cause is a reachable assertion or unhandled path in the URL routing code of cockpit-ws. The service correctly processes requests to UrlRoot with a trailing slash but fails to normalize or handle the case where the request URI matches the prefix exactly. This inconsistency causes the process to abort rather than issue a redirect or a benign response.

Attack Vector

Exploitation requires only network access to the Cockpit web service. An attacker sends a single crafted GET request to the configured URL root prefix, omitting the trailing slash. The cockpit-ws process terminates immediately upon processing the request. See the Red Hat CVE-2026-91147 Advisory and Red Hat Bug #2479230 Details for additional technical context.

Detection Methods for CVE-2026-91147

Indicators of Compromise

Unexpected termination or repeated restarts of the cockpit-ws systemd service on affected hosts.
HTTP access logs showing requests to the configured WebService.UrlRoot path without a trailing slash from unfamiliar source addresses.
Gaps in Cockpit web console availability that correlate with inbound network requests to the Cockpit listening port.

Detection Strategies

Monitor systemd journal entries for cockpit-ws.service failures and abnormal exit codes.
Inspect reverse proxy or web server access logs for repeated requests matching the URL root prefix pattern without a trailing slash.
Correlate service crash events with network telemetry to identify the originating source of malformed requests.

Monitoring Recommendations

Configure alerting on cockpit-ws process termination and service restart counters exceeding a baseline threshold.
Enable verbose logging on the Cockpit host and forward events to a centralized logging platform for retention and analysis.
Track availability metrics for the Cockpit management interface to identify sustained denial of service attempts.

How to Mitigate CVE-2026-91147

Immediate Actions Required

Apply vendor updates from Red Hat or your Linux distribution as soon as fixed cockpit-ws packages become available.
Restrict network access to the Cockpit web service using host firewalls, VPN gating, or network segmentation until patches are deployed.
Review cockpit.conf and remove or reconfigure WebService.UrlRoot if it is not required in your environment.

Patch Information

Refer to the Red Hat CVE-2026-91147 Advisory for the authoritative list of fixed package versions and errata. Red Hat tracks remediation progress in Red Hat Bug #2479230 Details. Upstream Cockpit users should monitor the project's release notes for the fixed cockpit-ws version.

Workarounds

Remove the UrlRoot configuration from the [WebService] section of cockpit.conf and restart cockpit.socket to eliminate the vulnerable code path.
Place a reverse proxy in front of cockpit-ws that normalizes incoming request paths and appends a trailing slash to requests targeting the URL root prefix.
Limit inbound access to the Cockpit port (default TCP 9090) to trusted management networks or jump hosts.

bash

# Restrict Cockpit access to a trusted management subnet using firewalld
sudo firewall-cmd --permanent --zone=drop --add-service=cockpit
sudo firewall-cmd --permanent --zone=internal --add-service=cockpit
sudo firewall-cmd --permanent --zone=internal --add-source=10.10.0.0/24
sudo firewall-cmd --reload

# Restart Cockpit after removing UrlRoot from /etc/cockpit/cockpit.conf
sudo systemctl restart cockpit.socket