# CVE-2026-4631: cockpit: Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client... CVE-2026-4631 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-4631, released April 7, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-4631 - Priority: Urgent - CVSS: 9.8 (critical) - EPSS: 0.1548 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 7, 2026 ## Description Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | cockpit Debian 13.5 (trixie) | 337-1+deb13u1 | [DEBIAN-CVE-2026-4631](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4631.md) | Apr 7, 2026 | | Linux | cockpit Debian 14 | 360-1 | [DEBIAN-CVE-2026-4631](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4631.md) | Apr 7, 2026 | | Linux | cockpit RHEL 10 | 334.1-3.el10_0 | [RHSA-2026:7381](https://patchblox.com/security/data/fix/linux/rhsa-2026-7381.md) | Apr 15, 2026 | | Linux | cockpit RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit opensuse-leap 16.0 | 364-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit rocky 10 | 0:344-3.el10_1.rocky.0.1 | [RLSA-2026:7383](https://patchblox.com/security/data/fix/linux/rlsa-2026-7383.md) | May 21, 2026 | | Linux | cockpit rocky 9 | 0:344-2.el9_7.rocky.0.1 | [RLSA-2026:7384](https://patchblox.com/security/data/fix/linux/rlsa-2026-7384.md) | May 21, 2026 | | Linux | cockpit sles 16.0 | 364-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-bridge RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-bridge almalinux 10 | 344-3.el10_1 | [ALSA-2026:7383](https://patchblox.com/security/data/fix/linux/alsa-2026-7383.md) | Apr 10, 2026 | | Linux | cockpit-bridge almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-bridge ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-bridge ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-doc RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-doc almalinux 10 | 344-3.el10_1 | [ALSA-2026:7383](https://patchblox.com/security/data/fix/linux/alsa-2026-7383.md) | Apr 10, 2026 | | Linux | cockpit-doc almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-doc ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-doc ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-machines opensuse-leap 16.0 | 354-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit-machines sles 16.0 | 354-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-packagekit RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-packagekit almalinux 10 | 344-3.el10_1 | [ALSA-2026:7383](https://patchblox.com/security/data/fix/linux/alsa-2026-7383.md) | Apr 10, 2026 | | Linux | cockpit-packagekit almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-packagekit ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-packagekit ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-packages opensuse-leap 16.0 | 5-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit-packages sles 16.0 | 5-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-podman opensuse-leap 16.0 | 128-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit-podman sles 16.0 | 128-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-repos opensuse-leap 16.0 | 4.8-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit-repos sles 16.0 | 4.8-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-storaged RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-storaged almalinux 10 | 344-3.el10_1 | [ALSA-2026:7383](https://patchblox.com/security/data/fix/linux/alsa-2026-7383.md) | Apr 10, 2026 | | Linux | cockpit-storaged almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-storaged ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-storaged ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-subscriptions opensuse-leap 16.0 | 16.2-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 | | Linux | cockpit-subscriptions sles 16.0 | 16.2-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 | | Linux | cockpit-system RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-system almalinux 10 | 344-3.el10_1 | [ALSA-2026:7383](https://patchblox.com/security/data/fix/linux/alsa-2026-7383.md) | Apr 10, 2026 | | Linux | cockpit-system almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-system ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-system ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-ws RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-ws almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-ws ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-ws ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-ws-selinux RHEL 9 | 0:344-2.el9_7 | [RHSA-2026:7384](https://patchblox.com/security/data/fix/linux/rhsa-2026-7384.md) | Apr 15, 2026 | | Linux | cockpit-ws-selinux almalinux 9 | 344-2.el9_7 | [ALSA-2026:7384](https://patchblox.com/security/data/fix/linux/alsa-2026-7384.md) | Apr 10, 2026 | | Linux | cockpit-ws-selinux ol 10 | 0:344-3.0.1.el10_1 | [ELSA-2026-7383](https://patchblox.com/security/data/fix/linux/elsa-2026-7383.md) | Apr 14, 2026 | | Linux | cockpit-ws-selinux ol 9 | 0:344-2.0.1.el9_7 | [ELSA-2026-7384](https://patchblox.com/security/data/fix/linux/elsa-2026-7384.md) | Apr 10, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.