CVE-2026-92745: Cockpit-Machines Token Disclosure Flaw

CVE-2026-92745 Overview

CVE-2026-92745 is an information disclosure vulnerability in cockpit-machines, the virtual machine management module for the Cockpit web-based server administration interface. The flaw exposes a Red Hat Subscription Management (RHSM) offline token when the token is passed as a command-line argument to a helper script during token validation. Any local user able to inspect process metadata, such as via /proc/<pid>/cmdline, can read the token. Attackers can then use the recovered token to request valid RHSM access tokens and impersonate the affected subscription. The weakness is classified as [CWE-214: Invocation of Process Using Visible Sensitive Information].

Critical Impact
A local, authenticated attacker can harvest a Red Hat Subscription Management offline token from process arguments and use it to request access tokens against Red Hat services.

Affected Products

Red Hat cockpit-machines package (see Red Hat CVE-2026-92745 Advisory for the authoritative list of affected builds)
Red Hat Enterprise Linux systems running Cockpit with the virtual machines module
Environments using RHSM offline token workflows through Cockpit

Discovery Timeline

2026-09-18 - CVE-2026-92745 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-92745

Vulnerability Analysis

The cockpit-machines module integrates RHSM workflows to help administrators manage subscription entitlements for virtual machines. During the token validation step, the module invokes a helper script and passes the RHSM offline token directly on the command line. On Linux, command-line arguments for any process are world-readable via /proc/<pid>/cmdline, so any unprivileged local account can enumerate the token while the helper process runs.

RHSM offline tokens are long-lived refresh credentials. An attacker who reads the token can exchange it at Red Hat's authentication endpoint to obtain short-lived access tokens tied to the victim's subscription. This yields confidentiality impact on subscription data and API access, though integrity and availability of the local host are not directly affected. Exploitation requires an interactive user to trigger the token validation flow, which is why the CVSS vector includes user interaction.

Root Cause

The root cause is passing sensitive authentication material as a command-line argument instead of via a secure channel such as standard input, an environment variable scoped to the child process, or a file with restricted permissions. This pattern is enumerated by [CWE-214] and applies broadly to any secret rendered into argv.

Attack Vector

A local user with shell access polls /proc for the helper script invocation, reads the cmdline entry, and extracts the offline token. The attacker then submits the token to the RHSM OAuth endpoint to mint access tokens. Refer to the Red Hat Bug Report #2476266 for the technical discussion. No exploit code is publicly available for CVE-2026-92745 at the time of writing.

Detection Methods for CVE-2026-92745

Indicators of Compromise

Unexpected reads of /proc/<pid>/cmdline by non-root local users on Cockpit-managed hosts
Presence of RHSM offline token strings in shell history, audit logs, or process accounting records
Unrecognized RHSM access token issuance events tied to the affected subscription account

Detection Strategies

Audit process argument capture on Linux via auditd rules that flag reads of /proc/*/cmdline for processes owned by other users
Correlate cockpit-machines helper script executions with concurrent access from unprivileged accounts
Monitor Red Hat Customer Portal for anomalous token exchange activity against the RHSM API

Monitoring Recommendations

Ingest execve telemetry with full command-line arguments into your SIEM and alert on secrets patterns appearing in argv
Track Cockpit session activity and correlate with local logins on the same host
Review /var/log/audit/audit.log for PATH records referencing helper scripts invoked by cockpit-machines

How to Mitigate CVE-2026-92745

Immediate Actions Required

Apply the updated cockpit-machines package published by Red Hat as soon as it is available for your distribution
Rotate any RHSM offline tokens that may have been used through the Cockpit interface on a shared or multi-user host
Restrict interactive shell access on servers running Cockpit to trusted administrators only

Patch Information

Consult the Red Hat CVE-2026-92745 Advisory for the fixed package versions and errata identifiers applicable to your Red Hat Enterprise Linux release. Update through dnf or your standard patch management pipeline once the errata are published.

Workarounds

Avoid using the RHSM token validation feature in cockpit-machines on multi-user systems until the patched package is installed
Mount /proc with the hidepid=2 option so users can only see their own processes, reducing exposure of cmdline data
Limit membership in the wheel and Cockpit-authorized groups to reduce the pool of local users able to observe process metadata

bash

# Restrict /proc visibility so users only see their own processes
sudo mount -o remount,hidepid=2,gid=proc /proc

# Persist the setting in /etc/fstab
echo 'proc /proc proc defaults,hidepid=2,gid=proc 0 0' | sudo tee -a /etc/fstab

# Apply available cockpit-machines updates
sudo dnf update cockpit-machines