Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-92747
5.0 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
References
Affected products
cockpit-machines
Matching in nixpkgs
pkgs.cockpit-machines
Cockpit UI for virtual machines
Package maintainers
-
@lucasew Lucas Eduardo Wendt <lucas59356@gmail.com>
-
@alexandru0-dev Alexandru Nechita <alexandru.italia32+nixpkgs@gmail.com>
-
@andre4ik3 andre4ik3 <andre4ik3@fastmail.com>