CVE-2026-92745

Name	CVE-2026-92745
Description	A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cockpit-machines (PTS)	bookworm	288-1	vulnerable
	trixie	332-1	vulnerable
	forky, sid	357-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cockpit-machines	source	(unstable)	357-1

Notes

[trixie] - cockpit-machines <no-dsa> (Minor issue)
[bookworm] - cockpit-machines <postponed> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2476266