CVE-2026-113495

Name	CVE-2026-113495
Description	A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1152782

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cockpit-machines (PTS)	bookworm	288-1	vulnerable
	trixie	332-1	vulnerable
	forky, sid	360-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cockpit-machines	source	(unstable)	360-1	unimportant		1152782

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2556057
https://github.com/advisories/GHSA-rq8f-q9xv-wmhm
Fixed by: https://github.com/cockpit-project/cockpit-machines/commit/b058e6872778d1ae362634b44463adf387ba49ea
Not relevant on Debian systems