CVE-2026-92747 Overview
CVE-2026-92747 is an information disclosure vulnerability in cockpit-machines, the virtual machine management module for the Cockpit web-based server administration interface. The flaw allows a local attacker with the ability to inspect running processes to view sensitive guest VM credentials, including rootPassword and userPassword values. The install_machine.py script passes these credentials as a JSON command-line argument during virtual machine creation or installation. Any local user able to read process command-line arguments through /proc can capture these secrets while the installation workflow is active. The issue is classified under [CWE-214: Invocation of Process Using Visible Sensitive Information].
Critical Impact
Local users with process-visibility permissions can harvest guest VM root and user passwords during Cockpit-driven VM installation, enabling downstream compromise of freshly provisioned virtual machines.
Affected Products
- Red Hat cockpit-machines package
- Systems where install_machine.py orchestrates VM provisioning
- Cockpit deployments with multiple local users or shared shell access
Discovery Timeline
- 2026-09-18 - CVE-2026-92747 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-92747
Vulnerability Analysis
The vulnerability resides in how cockpit-machines invokes the install_machine.py helper during VM provisioning. Guest credentials submitted through the Cockpit web interface are serialized into a JSON structure and passed as a command-line argument to the installer process. On Linux, process command-line arguments are exposed through /proc/<pid>/cmdline, which is readable by other local accounts under default host process-visibility policies.
Any local user running ps, cat /proc/<pid>/cmdline, or an equivalent process inspection tool during the installation window can retrieve the plaintext rootPassword and userPassword values. Exposure is bounded by the lifetime of the installation workflow, but a low-privileged attacker polling /proc at short intervals can reliably capture the credentials.
Root Cause
The root cause is the transmission of secrets through a process argument rather than through a private channel such as an environment file, a Unix pipe, standard input, or a restricted temporary file. Command-line arguments are metadata visible to unrelated processes and users, making them an unsuitable transport for authentication material.
Attack Vector
Exploitation requires local access with authenticated but low-privileged credentials. The attacker does not need root and does not interact with the Cockpit web interface. User interaction from an administrator is required to trigger the vulnerable VM installation workflow. Impact is limited to confidentiality of the guest credentials; integrity and availability of the host are not directly affected. Successful capture of the guest rootPassword enables the attacker to authenticate to the newly provisioned virtual machine.
No verified public proof-of-concept code is available. See the Red Hat CVE-2026-92747 Advisory and Red Hat Bug Report #2469260 for vendor technical details.
Detection Methods for CVE-2026-92747
Indicators of Compromise
- Unexpected reads of /proc/<pid>/cmdline by non-administrative accounts while a cockpit-machines installation is running
- Repeated invocations of ps, pgrep, or similar utilities by unprivileged users targeting install_machine.py
- Local user sessions active on the Cockpit host concurrent with VM provisioning events
Detection Strategies
- Audit process execution and correlate install_machine.py invocations with concurrent process-listing activity by other users
- Enable Linux audit rules (auditd) on /proc/*/cmdline access patterns and on execution of python3 .../install_machine.py
- Review Cockpit session logs for VM creation events and cross-reference against local shell login records in wtmp and journald
Monitoring Recommendations
- Alert on any non-root user executing ps auxww, ps -ef, or reading /proc/<pid>/cmdline for processes owned by administrators
- Monitor for new local SSH or console sessions immediately preceding or during VM provisioning windows
- Track authentication attempts against newly created guest VMs to identify credential reuse from a leaked password
How to Mitigate CVE-2026-92747
Immediate Actions Required
- Apply vendor updates to cockpit-machines as soon as fixed packages are published by Red Hat
- Restrict interactive local access to Cockpit hosts to trusted administrators only
- Rotate rootPassword and userPassword for any guest VMs provisioned through Cockpit prior to patching
- Avoid using the Cockpit VM installation workflow to set guest credentials until the patch is deployed; set passwords out-of-band after installation
Patch Information
Refer to the Red Hat CVE-2026-92747 Advisory for authoritative patch availability and package versions. Track Red Hat Bug Report #2469260 for engineering status.
Workarounds
- Enable the kernel hidepid=2 mount option on /proc so users cannot inspect processes owned by other accounts
- Limit membership of the wheel and Cockpit administrative groups to reduce the set of accounts able to trigger installations
- Provision guest VMs without embedded credentials and configure authentication post-install through cloud-init, Ansible, or console access
# Restrict /proc visibility so non-owner users cannot read cmdline of other processes
# Add to /etc/fstab and remount, or apply at runtime:
mount -o remount,rw,hidepid=2,gid=proc /proc
# Persist across reboots via /etc/fstab
# proc /proc proc defaults,hidepid=2,gid=proc 0 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
