{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for cockpit-machines is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Cockpit component for managing libvirt virtual machines.\n\nSecurity Fix(es):\n\n* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)\n\n* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)\n\n* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:98459",
        "url": "https://access.redhat.com/errata/RHSA-2026:98459"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2469258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258"
      },
      {
        "category": "external",
        "summary": "2469260",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469260"
      },
      {
        "category": "external",
        "summary": "2476266",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476266"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98459.json"
      }
    ],
    "title": "Red Hat Security Advisory: cockpit-machines security update",
    "tracking": {
      "current_release_date": "2026-11-11T11:49:47+00:00",
      "generator": {
        "date": "2026-11-11T11:49:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:98459",
      "initial_release_date": "2026-11-11T11:47:18+00:00",
      "revision_history": [
        {
          "date": "2026-11-11T11:47:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-11T11:47:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-11T11:49:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.9.0.Z.MAIN",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-machines-0:355.1-1.el9_9.src",
                "product": {
                  "name": "cockpit-machines-0:355.1-1.el9_9.src",
                  "product_id": "cockpit-machines-0:355.1-1.el9_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-machines@355.1-1.el9_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cockpit-machines-0:355.1-1.el9_9.noarch",
                "product": {
                  "name": "cockpit-machines-0:355.1-1.el9_9.noarch",
                  "product_id": "cockpit-machines-0:355.1-1.el9_9.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-machines@355.1-1.el9_9?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-machines-0:355.1-1.el9_9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch"
        },
        "product_reference": "cockpit-machines-0:355.1-1.el9_9.noarch",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-machines-0:355.1-1.el9_9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
        },
        "product_reference": "cockpit-machines-0:355.1-1.el9_9.src",
        "relates_to_product_reference": "AppStream-9.9.0.Z.MAIN"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-92745",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2026-05-11T20:27:44+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2476266"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This local information disclosure vulnerability in `cockpit-machines` exposes the RHSM offline token via process arguments during token validation. Exploitation requires local access to the host, the ability to inspect process metadata while the validation flow is active, and a system without restrictive `/proc` visibility settings.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92745"
        },
        {
          "category": "external",
          "summary": "RHBZ#2476266",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476266"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92745"
        }
      ],
      "release_date": "2026-09-18T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T11:47:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98459"
        },
        {
          "category": "workaround",
          "details": "A workaround is available for this issue. Until a fixed package is installed, avoid validating RHSM offline tokens through the Cockpit Machines \"Download an OS\" / RHEL image download flow on multi-user hosts where untrusted local users can inspect process metadata. As a system-level mitigation, restrict /proc visibility so unprivileged users cannot read other users\u0027 process command lines, for example by remounting /proc with the hidepid=2 mount option; this blocks cross-user observation of the helper process arguments that contain the offline token while the validation flow is running. Fixed packages are being released for the affected streams, and updating to a fixed cockpit-machines package once available for your stream resolves the issue.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-92747",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2026-05-11T19:59:32+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2469260"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in `cockpit-machines` can lead to sensitive data exposure of guest VM credentials. When creating or installing a VM with password fields populated, `install_machine.py` passes these credentials as a JSON command-line argument. This makes them visible to other local users on the host who can inspect running processes, but only while the installation workflow is active and if host process-visibility policies permit.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92747"
        },
        {
          "category": "external",
          "summary": "RHBZ#2469260",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469260"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92747",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92747"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92747",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92747"
        }
      ],
      "release_date": "2026-09-18T16:35:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T11:47:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98459"
        },
        {
          "category": "workaround",
          "details": "Exposure can be reduced by avoiding VM creation or installation flows that supply rootPassword or userPassword while untrusted local users are active on the host, and by using an alternative provisioning method where one is available. Restricting cross-user process inspection on the host, for example by hardening /proc visibility with the hidepid mount option, also limits the ability of other local users to read the install_machine.py command line. These measures reduce the exposure window but do not remove the underlying issue of credentials being passed in process arguments; they should be treated as temporary risk reduction until a fixed cockpit-machines package is available.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-92768",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2026-05-11T19:59:32+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2469258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in `cockpit-machines` allows local attackers to expose sensitive VM credentials. During VM creation or installation, passwords passed via command-line arguments can be read by other local users if `/proc` visibility is not restricted. Exploitation requires local access and a specific execution window, but successful attacks can lead to full credential disclosure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
          "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92768"
        },
        {
          "category": "external",
          "summary": "RHBZ#2469258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2469258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92768",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92768"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92768",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92768"
        }
      ],
      "release_date": "2026-09-18T16:36:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-11T11:47:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:98459"
        },
        {
          "category": "workaround",
          "details": "Restrict visibility of process command-line arguments to other local users by mounting /proc with the hidepid=2 option, for example by remounting /proc with \u0027mount -o remount,hidepid=2 /proc\u0027 or configuring \u0027proc /proc proc defaults,hidepid=2 0 0\u0027 in /etc/fstab. This prevents unprivileged local users from reading other users\u0027 process arguments. Additionally, on shared hosts where other local users can inspect process arguments, avoid supplying root or user passwords through the Cockpit Machines VM create and install flows, and prefer provisioning methods that do not pass passwords on the command line. Updated cockpit-machines packages that stop passing password material on the command line are being delivered for affected streams; installing the updated package once it is available for your stream resolves this issue.",
          "product_ids": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.noarch",
            "AppStream-9.9.0.Z.MAIN:cockpit-machines-0:355.1-1.el9_9.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments"
    }
  ]
}