CVE-2026-91203: Cockpit-Files Symlink Race Vulnerability

CVE-2026-91203 is a symlink race condition in cockpit-files that lets local attackers manipulate privileged file operations to alter ownership and permissions on arbitrary files, risking system integrity. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-91203 Overview

CVE-2026-91203 is a symlink race condition [CWE-363] in cockpit-files, a file management component of the Cockpit web-based server administration interface. A local attacker with limited privileges can exploit a time-of-check to time-of-use (TOCTOU) window during privileged file operations. By manipulating directory entries and winning the race, the attacker can redirect operations such as ownership or permission changes to unintended files.

Successful exploitation can alter ownership and permissions of arbitrary files on the target system. This can compromise integrity and availability by modifying system or application state or rendering services unusable.

Critical Impact
Successful exploitation allows a local unprivileged attacker to modify ownership and permissions on arbitrary files, enabling privilege escalation paths and service disruption.

Affected Products

cockpit-files (Cockpit web console file management component)
Red Hat distributions shipping affected cockpit-files builds
Downstream Linux distributions packaging vulnerable cockpit-files versions

Discovery Timeline

2026-09-18 - CVE-2026-91203 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-91203

Vulnerability Analysis

The flaw is a classic symlink race condition falling under [CWE-363] (Race Condition Enabling Link Following). During privileged file operations, cockpit-files performs checks against a path and then acts on that path in a separate step. A local attacker can swap a legitimate directory entry for a symbolic link between these two operations.

When the privileged operation resolves the path after the swap, it follows the attacker-controlled symlink to an arbitrary target file. Operations such as chown and chmod executed by the privileged Cockpit backend then apply to files the attacker could not otherwise modify.

Exploitation requires local access, user interaction, and a successful race win, which explains the high attack complexity. When the race succeeds, however, the integrity and availability impact is high because the attacker controls which file receives the ownership or permission change.

Root Cause

The root cause is non-atomic handling of path resolution during privileged file operations. cockpit-files validates a path or file object at one point in time, then reopens or reoperates on the path later without ensuring the target has not changed. This gap allows an attacker to substitute a symlink between check and use.

Attack Vector

The attack vector is local. An unprivileged user on the same system as the Cockpit backend performs concurrent filesystem operations while inducing a privileged user or administrator to trigger an ownership or permission change through the Cockpit web console. The attacker races the privileged operation, replacing a directory entry with a symlink pointing to a sensitive file such as /etc/shadow or a service unit file.

Refer to the Red Hat CVE-2026-91203 Advisory and Red Hat Bug Report #2465632 for vendor technical details.

Detection Methods for CVE-2026-91203

Indicators of Compromise

Unexpected ownership or permission changes on sensitive files such as /etc/passwd, /etc/shadow, or files under /etc/systemd/.
Audit records showing chown or chmod syscalls issued by the Cockpit backend against paths outside expected user home directories.
Rapid creation and deletion of symbolic links by unprivileged users during Cockpit administrative activity.

Detection Strategies

Enable Linux auditd rules on chown, chmod, fchownat, and fchmodat syscalls originating from Cockpit service processes.
Correlate Cockpit web console activity logs with filesystem modification events to identify path-target mismatches.
Monitor for unprivileged processes creating symbolic links inside directories that Cockpit operates on with elevated privileges.

Monitoring Recommendations

Forward auditd, cockpit.service journal entries, and filesystem change events to a centralized log platform for correlation.
Alert on ownership changes that grant a non-root user access to root-owned system files.
Baseline normal Cockpit file operation patterns and alert on deviations affecting sensitive filesystem locations.

How to Mitigate CVE-2026-91203

Immediate Actions Required

Apply the vendor-supplied cockpit-files update as soon as it is available for your distribution.
Restrict Cockpit web console access to trusted administrative accounts using firewall rules and PAM configuration.
Limit local shell access on systems running Cockpit to reduce the population of potential local attackers.

Patch Information

Consult the Red Hat CVE-2026-91203 Advisory for fixed package versions and errata identifiers. Track your distribution's security channel for the corresponding cockpit-files update and apply it through your standard patch management process.

Workarounds

Disable or stop the cockpit.socket and cockpit.service units on systems that do not require the web console until patches are applied.
Avoid performing ownership or permission changes through the Cockpit file manager on multi-user systems.
Enforce strict filesystem permissions on shared directories to reduce opportunities for symlink substitution.

bash

# Disable Cockpit until a patched cockpit-files is installed
sudo systemctl stop cockpit.socket cockpit.service
sudo systemctl disable cockpit.socket cockpit.service

# After patching, verify the installed cockpit-files version
rpm -q cockpit-files