CVE-2026-91149: Cockpit TLS Service DoS Vulnerability

CVE-2026-91149 Overview

CVE-2026-91149 is a denial of service vulnerability in Cockpit, the web-based server management interface commonly deployed on Red Hat Enterprise Linux and other Linux distributions. The flaw resides in the cockpit-tls service, which fails to bound the number of detached threads spawned in response to incoming TLS connections. An unauthenticated remote attacker can open and sustain numerous simultaneous connections, forcing the service to allocate memory and file descriptors without limit. The result is degradation or complete unavailability of the Cockpit management interface for legitimate administrators. The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated network attackers can exhaust system resources on Cockpit-managed hosts, disabling remote administration access and potentially impacting co-located services on the same host.

Affected Products

Cockpit web-based server management interface (cockpit-tls component)
Red Hat Enterprise Linux distributions shipping Cockpit
Downstream Linux distributions packaging affected Cockpit versions

Discovery Timeline

2026-09-18 - CVE-2026-91149 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-91149

Vulnerability Analysis

Cockpit exposes a TLS-terminating front-end service, cockpit-tls, that handles incoming HTTPS connections before proxying them to the Cockpit bridge. For each new connection, the service spawns a detached worker thread to process the session. The service does not enforce a ceiling on concurrent threads or on the rate of new connections from a single source.

An attacker who opens many connections in parallel, and keeps them open, causes the process to accumulate detached threads indefinitely. Each thread consumes stack memory, kernel scheduling structures, and at least one file descriptor. When memory or the per-process file descriptor limit is exhausted, the service stops accepting new sessions and administrators lose remote management access.

Exploitation requires no authentication, no user interaction, and no prior foothold. The attack is delivered over the network against any host exposing cockpit-tls on its default port.

Root Cause

The root cause is missing resource throttling in the connection acceptance path of cockpit-tls. The service creates a new detached thread per connection without applying a concurrency cap, per-client connection limit, or backpressure mechanism. This maps directly to CWE-770: Allocation of Resources Without Limits or Throttling.

Attack Vector

The attacker sends a high volume of TLS connection attempts to the Cockpit endpoint, typically TCP port 9090, and holds those connections open. No credentials, tokens, or valid Cockpit sessions are required. Because the connections are network-reachable, the attack can be sourced from any host with network path to the target.

No verified proof-of-concept code is publicly available. See the Red Hat CVE-2026-91149 Advisory and Red Hat Bug #2479422 Report for vendor technical details.

Detection Methods for CVE-2026-91149

Indicators of Compromise

Sudden growth in the thread count of the cockpit-tls process, observable via ps -T or /proc/<pid>/status.
Rapid increase in open file descriptors for the Cockpit service, visible in /proc/<pid>/fd/ or lsof.
Large numbers of half-open or idle TLS connections to TCP port 9090 from a small set of source addresses.
Systemd journal entries showing cockpit-tls failing to accept new connections or exiting due to resource exhaustion.

Detection Strategies

Monitor per-process resource metrics for cockpit-tls, including thread count, resident memory, and file descriptor usage, and alert on sharp deviations.
Correlate netflow or connection-tracking data with Cockpit port usage to detect abnormal connection concurrency from single sources.
Ingest systemd and audit logs into a centralized SIEM to catch service restarts, OOM kills, or EMFILE errors tied to Cockpit.

Monitoring Recommendations

Baseline normal Cockpit connection volumes per host and alert on multiples of that baseline.
Track host-level file descriptor and thread ceilings, and generate alerts as thresholds are approached.
Log and review all inbound connections to management interfaces, restricting exposure to trusted networks.

How to Mitigate CVE-2026-91149

Immediate Actions Required

Restrict network access to Cockpit's port, typically TCP 9090, using host firewalls or network ACLs so only trusted management subnets can connect.
Place Cockpit behind a VPN or bastion host to eliminate direct exposure to untrusted networks.
Apply vendor security updates for the Cockpit package as soon as they are available from your Linux distribution.
Monitor the Cockpit service for abnormal thread or file descriptor growth and prepare a restart runbook for responders.

Patch Information

At publication, refer to the Red Hat CVE-2026-91149 Advisory and the corresponding Red Hat Bug #2479422 Report for patch status and fixed package versions. Apply updates through your distribution's package manager once released and restart the cockpit.socket and cockpit-tls units to load the patched binaries.

Workarounds

Disable the Cockpit service (systemctl disable --now cockpit.socket) on hosts where it is not required.
Enforce per-source connection limits at the firewall using iptables or nftables rate-limiting rules against port 9090.
Lower the systemd unit's LimitNOFILE and TasksMax values to contain resource impact, accepting that legitimate sessions may also be limited.
Front Cockpit with a reverse proxy that enforces connection concurrency and rate limits before traffic reaches cockpit-tls.

bash

# Example nftables rule limiting concurrent connections per source to Cockpit
nft add rule inet filter input tcp dport 9090 \
  ct state new meter cockpit_conn { ip saddr limit rate 10/minute } accept
nft add rule inet filter input tcp dport 9090 drop