# CVE-2026-4802: cockpit: A flaw was found in Cockpit

CVE-2026-4802 is fixed in 13 products on 1 platform, first by RHSA-2026:21390, released May 11, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-4802
- Priority: High
- CVSS: 8.0 (high)
- EPSS: 0.0102
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 11, 2026

## Description

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cockpit Debian 13.5 (trixie) | 337-1+deb13u2 | [DEBIAN-CVE-2026-4802](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4802.md) | May 11, 2026 |
| Linux | cockpit Debian 14 | 362-1 | [DEBIAN-CVE-2026-4802](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4802.md) | May 11, 2026 |
| Linux | cockpit RHEL 10 | 334.2-1.el10_0 | [RHSA-2026:21390](https://patchblox.com/security/data/fix/linux/rhsa-2026-21390.md) | May 11, 2026 |
| Linux | cockpit RHEL 8 | 0:310.8-1.el8_10 | [RHSA-2026:21700](https://patchblox.com/security/data/fix/linux/rhsa-2026-21700.md) | Jun 24, 2026 |
| Linux | cockpit RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit almalinux 8 | 310.8-1.el8_10 | [ALSA-2026:21700](https://patchblox.com/security/data/fix/linux/alsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit ol 8 | 0:310.8-1.0.1.el8_10 | [ELSA-2026-21700](https://patchblox.com/security/data/fix/linux/elsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit opensuse-leap 16.0 | 364-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit rocky 10 | 0:356.2-1.el10_2.rocky.0.1 | [RLSA-2026:21676](https://patchblox.com/security/data/fix/linux/rlsa-2026-21676.md) | Jun 4, 2026 |
| Linux | cockpit rocky 8 | 0:310.8-1.el8_10 | [RLSA-2026:21700](https://patchblox.com/security/data/fix/linux/rlsa-2026-21700.md) | May 29, 2026 |
| Linux | cockpit rocky 9 | 0:356.2-1.el9_8.rocky.0.1 | [RLSA-2026:21468](https://patchblox.com/security/data/fix/linux/rlsa-2026-21468.md) | May 30, 2026 |
| Linux | cockpit sles 16.0 | 364-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-bridge RHEL 8 | 0:310.8-1.el8_10 | [RHSA-2026:21700](https://patchblox.com/security/data/fix/linux/rhsa-2026-21700.md) | Jun 24, 2026 |
| Linux | cockpit-bridge RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-bridge almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-bridge almalinux 8 | 310.8-1.el8_10 | [ALSA-2026:21700](https://patchblox.com/security/data/fix/linux/alsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-bridge almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-bridge ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-bridge ol 8 | 0:310.8-1.0.1.el8_10 | [ELSA-2026-21700](https://patchblox.com/security/data/fix/linux/elsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-bridge ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-doc RHEL 8 | 0:310.8-1.el8_10 | [RHSA-2026:21700](https://patchblox.com/security/data/fix/linux/rhsa-2026-21700.md) | Jun 24, 2026 |
| Linux | cockpit-doc RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-doc almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-doc almalinux 8 | 310.8-1.el8_10 | [ALSA-2026:21700](https://patchblox.com/security/data/fix/linux/alsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-doc almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-doc ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-doc ol 8 | 0:310.8-1.0.1.el8_10 | [ELSA-2026-21700](https://patchblox.com/security/data/fix/linux/elsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-doc ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-machines opensuse-leap 16.0 | 354-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit-machines sles 16.0 | 354-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-packagekit RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-packagekit almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-packagekit almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-packagekit ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-packagekit ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-packages opensuse-leap 16.0 | 5-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit-packages sles 16.0 | 5-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-podman opensuse-leap 16.0 | 128-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit-podman sles 16.0 | 128-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-repos opensuse-leap 16.0 | 4.8-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit-repos sles 16.0 | 4.8-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-storaged RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-storaged almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-storaged almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-storaged ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-storaged ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-subscriptions opensuse-leap 16.0 | 16.2-160000.1.1 | [OPENSUSE-SU-2026:21399-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21399-1.md) | Jul 21, 2026 |
| Linux | cockpit-subscriptions sles 16.0 | 16.2-160000.1.1 | [SUSE-SU-2026:22837-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22837-1.md) | Jul 21, 2026 |
| Linux | cockpit-system RHEL 8 | 0:310.8-1.el8_10 | [RHSA-2026:21700](https://patchblox.com/security/data/fix/linux/rhsa-2026-21700.md) | Jun 24, 2026 |
| Linux | cockpit-system RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-system almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-system almalinux 8 | 310.8-1.el8_10 | [ALSA-2026:21700](https://patchblox.com/security/data/fix/linux/alsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-system almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-system ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-system ol 8 | 0:310.8-1.0.1.el8_10 | [ELSA-2026-21700](https://patchblox.com/security/data/fix/linux/elsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-system ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-ws RHEL 8 | 0:310.8-1.el8_10 | [RHSA-2026:21700](https://patchblox.com/security/data/fix/linux/rhsa-2026-21700.md) | Jun 24, 2026 |
| Linux | cockpit-ws RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-ws almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-ws almalinux 8 | 310.8-1.el8_10 | [ALSA-2026:21700](https://patchblox.com/security/data/fix/linux/alsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-ws almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-ws ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-ws ol 8 | 0:310.8-1.0.1.el8_10 | [ELSA-2026-21700](https://patchblox.com/security/data/fix/linux/elsa-2026-21700.md) | May 28, 2026 |
| Linux | cockpit-ws ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |
| Linux | cockpit-ws-selinux RHEL 9 | 0:356.2-1.el9_8 | [RHSA-2026:21468](https://patchblox.com/security/data/fix/linux/rhsa-2026-21468.md) | Jun 24, 2026 |
| Linux | cockpit-ws-selinux almalinux 10 | 356.2-1.el10_2 | [ALSA-2026:21676](https://patchblox.com/security/data/fix/linux/alsa-2026-21676.md) | May 28, 2026 |
| Linux | cockpit-ws-selinux almalinux 9 | 356.2-1.el9_8 | [ALSA-2026:21468](https://patchblox.com/security/data/fix/linux/alsa-2026-21468.md) | May 27, 2026 |
| Linux | cockpit-ws-selinux ol 10 | 0:356.2-1.0.1.el10_2 | [ELSA-2026-21676](https://patchblox.com/security/data/fix/linux/elsa-2026-21676.md) | Jul 16, 2026 |
| Linux | cockpit-ws-selinux ol 9 | 0:356.2-1.0.1.el9_8 | [ELSA-2026-21468](https://patchblox.com/security/data/fix/linux/elsa-2026-21468.md) | Jun 23, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.