Advisories ยป MGASA-2026-0175

Updated cockpit packages fix security vulnerabilities

Publication date: 05 Jun 2026
Modification date: 05 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-4802 , CVE-2026-4631 , CVE-2026-4800

Description

CVE-2026-4631, Cockpit's remote login feature passes user-supplied
hostnames and usernames from the web interface to the SSH client without
validation or sanitization. An attacker with network access to the
Cockpit web service can craft a single HTTP request to the login
endpoint that injects malicious SSH options or shell commands, achieving
code execution on the Cockpit host without valid credentials. The
injection occurs during the authentication flow before any credential
verification takes place, meaning no login is required to exploit the
vulnerability.
CVE-2026-4800, lodash vulnerable to Code Injection via `_.template`
imports key names
CVE-2026-4802, A flaw was found in Cockpit. This vulnerability allows a
remote attacker to achieve arbitrary command execution on the host by
exploiting unsanitized user-controlled parameters within crafted links
in the system logs user interface (UI). An attacker can inject shell
metacharacters and command substitutions into these parameters, leading
to the execution of arbitrary shell commands on the affected system.
This could result in a complete system compromise.

References

SRPMS

9/core