CVE-2026-4631 — AI Deep Analysis Summary

🚨 **Essence**: Cockpit's remote login feature passes user-supplied hostnames/usernames to the SSH client **without validation**.…

🛡️ **CWE**: CWE-78 (OS Command Injection). <br>🔍 **Flaw**: The vulnerability stems from **unvalidated/un-sanitized input** during the authentication flow.…

🏢 **Vendor**: Red Hat. <br>📦 **Product**: Red Hat Enterprise Linux 10 (Cockpit component). <br>⚠️ **Scope**: Any instance of Cockpit with network access to the web service is potentially affected.

💀 **Privileges**: **Full Code Execution**. <br>📂 **Data**: Complete compromise of the Cockpit host. <br>🔓 **Access**: Achieved **without valid credentials**.…

📉 **Threshold**: **LOW**. <br>🌐 **Auth**: **No authentication required**. <br>⚙️ **Config**: Only requires **network access** to the Cockpit web service. A single crafted HTTP request is sufficient.

📜 **Public Exp**: **Yes**. <br>🔗 **PoC**: Available via ProjectDiscovery Nuclei templates (`CVE-2026-4631.yaml`).…

🔍 **Self-Check**: Scan for open Cockpit web interfaces. <br>🧪 **Testing**: Use Nuclei templates to test the login endpoint for command injection.…

🩹 **Official Fix**: **Yes**. <br>📋 **Advisories**: Red Hat issued multiple errata (RHSA-2026:7381, 7382, 7383, 7384). <br>✅ **Action**: Update Cockpit to the patched version via Red Hat repositories.

🚧 **Workaround**: If patching is delayed, **restrict network access** to the Cockpit web service. <br>🔒 **Mitigation**: Place behind a WAF or firewall that blocks malicious SSH option injections in HTTP requests.…

🔥 **Urgency**: **CRITICAL**. <br>📈 **Priority**: **P1**. <br>⚖️ **Reason**: CVSS 9.1 (High). No auth required + RCE + Easy exploitation = Immediate patching recommended.