CVE-2026-91202: Cockpit Files Privilege Escalation Flaw

CVE-2026-91202 Overview

CVE-2026-91202 is a symlink-following flaw in cockpit-files, the file management component of the Cockpit web console. A low-privileged local user can craft a directory containing a symbolic link and then invoke the privileged Paste as owner function to change ownership of files outside the intended paste target. The result is a data integrity compromise and, in some scenarios, unauthorized read access when the new ownership grants additional permissions. Exploitation requires an interactive user to select a non-original owner during the paste operation, so the attack depends on both attacker-controlled symlink placement and privileged user interaction. The weakness is classified under CWE-61: UNIX Symbolic Link (Symlink) Following.

Critical Impact
A local unprivileged user can trigger arbitrary file ownership changes on the host, undermining integrity of system files and enabling follow-on privilege escalation paths.

Affected Products

cockpit-files (Cockpit web console file manager component)
Red Hat distributions shipping cockpit-files (see Red Hat CVE-2026-91202 Advisory)
Downstream projects packaging the vulnerable cockpit-files versions

Discovery Timeline

2026-09-18 - CVE-2026-91202 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-91202

Vulnerability Analysis

The flaw lives in the Paste as owner workflow of cockpit-files. When a privileged operator pastes content that a low-privileged user has staged, the routine walks the source tree and applies ownership changes to each item it encounters. The walk does not adequately validate whether individual entries are symbolic links pointing outside the staged directory. As a result, chown-style operations follow attacker-placed links and rewrite ownership of unrelated files on the host filesystem. The attack surface is local, and successful exploitation depends on a privileged Cockpit user completing the paste and selecting a non-original owner. See the Red Hat Bug Report #2465834 for tracking details.

Root Cause

The root cause is symlink following during a privileged file operation, mapped to [CWE-61]. The Paste as owner code path treats symlink targets as legitimate members of the pasted directory tree rather than resolving and rejecting entries that escape the source root. There is no O_NOFOLLOW or equivalent guard on the ownership change, and no post-resolution check that the target still resides inside the intended directory.

Attack Vector

A local, low-privileged user prepares a directory containing one or more symbolic links whose targets are sensitive files such as /etc/shadow, service configuration files, or SUID binaries. The attacker then convinces or waits for a privileged Cockpit user to paste that directory using Paste as owner and select an alternate owner. The privileged operation traverses the staged directory, follows the attacker-controlled symlinks, and issues ownership changes against the real targets. The attacker gains ownership of files they could not otherwise modify, enabling subsequent tampering or privilege escalation.

No verified public exploit code is available for this issue. Refer to the Red Hat CVE-2026-91202 Advisory for authoritative technical details.

Detection Methods for CVE-2026-91202

Indicators of Compromise

Unexpected ownership changes on system files, particularly under /etc, /root, or service configuration directories, correlated in time with Cockpit session activity.
Presence of symbolic links inside user-writable directories that resolve to sensitive system paths shortly before a Cockpit paste operation.
Cockpit audit or journal entries showing Paste as owner actions initiated by administrative users on directories owned by unprivileged accounts.

Detection Strategies

Monitor auditd for chown and fchownat syscalls originating from Cockpit-related processes where the target path lies outside the expected working directory.
Alert on filesystem integrity changes to critical paths using tools such as AIDE, Tripwire, or the Linux kernel fanotify interface.
Correlate Cockpit web session logs with ownership change events on the host to identify suspicious paste operations.

Monitoring Recommendations

Ingest Cockpit and systemd-journal logs into a centralized log platform and retain ownership change events for post-incident review.
Track creation of symlinks in shared or user-writable directories, especially links pointing to paths outside the user's home directory.
Review privileged Cockpit user activity on a recurring cadence to identify unexpected Paste as owner usage.

How to Mitigate CVE-2026-91202

Immediate Actions Required

Apply the vendor-provided cockpit-files update as soon as it is available from your Linux distribution. Track availability through the Red Hat CVE-2026-91202 Advisory.
Restrict Cockpit administrative access to a small group of trusted operators and require multi-factor authentication for those accounts.
Instruct administrators to avoid using Paste as owner on directories staged by untrusted or low-privileged local users until patches are applied.

Patch Information

At publication time, refer to the Red Hat CVE-2026-91202 Advisory and Red Hat Bug Report #2465834 for fixed package versions and errata for your distribution. Apply the update through your standard package manager, for example dnf update cockpit-files on Red Hat–based systems, once the patched build is published.

Workarounds

Disable or restrict the cockpit-files module in environments where it is not required, leaving other Cockpit modules functional.
Limit local shell access on Cockpit-managed hosts so that only vetted users can stage directories that administrators might later paste.
Enforce mandatory access controls with SELinux or AppArmor to constrain what cockpit-files processes can modify outside their expected scope.

bash

# Restrict Cockpit access to a dedicated admin group and disable the files module
sudo groupadd cockpit-admins
sudo usermod -aG cockpit-admins <trusted-admin>
sudo tee /etc/cockpit/disallowed-users > /dev/null <<'EOF'
root
EOF
sudo rm -f /usr/share/cockpit/files/manifest.json
sudo systemctl restart cockpit.socket