CVE-2026-91151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91151", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-14T20:37:18.522Z", "datePublished": "2026-11-11T19:46:14.718Z", "dateUpdated": "2026-11-13T17:42:55.278Z"}, "containers": {"cna": {"title": "Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:366.1.1-1.el10_3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.3"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:356.4.1-1.el10_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.2"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:310.10.2-1.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:366.1.1-1.el9_9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:366.1.1-1.el9_9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:356.4.1-1.el9_8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.8::appstream", "cpe:/o:redhat:rhel_eus:9.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "devspaces/udi-base-rhel10", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "devspaces/udi-base-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "devspaces/udi-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:99599", "name": "RHSA-2026:99599", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99600", "name": "RHSA-2026:99600", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99601", "name": "RHSA-2026:99601", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99602", "name": "RHSA-2026:99602", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:99603", "name": "RHSA-2026:99603", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-91151", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478404", "name": "RHBZ#2478404", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"}, {"url": "https://github.com/cockpit-project/cockpit/releases/tag/372"}], "datePublic": "2026-11-10T23:59:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "Improper Link Resolution Before File Access", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access", "timeline": [{"lang": "en", "time": "2026-05-18T03:32:25.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-10T23:59:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-12T16:45:02.638Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478404", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T17:39:58.197487Z", "id": "CVE-2026-91151", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T17:42:55.278Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.3"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:366.1.1-1.el10_3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.2"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 10.2 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:356.4.1-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:310.10.2-1.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:366.1.1-1.el9_9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:366.1.1-1.el9_9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.8::appstream", "cpe:/o:redhat:rhel_eus:9.8::baseos"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 9.8 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:356.4.1-1.el9_8", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "cockpit", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "affected", "packageName": "devspaces/udi-base-rhel10", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "affected", "packageName": "devspaces/udi-base-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "affected", "packageName": "devspaces/udi-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}], "id": "CVE-2026-91151", "lastModified": "2026-11-12T17:17:47.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2026-11-11T20:17:10.557", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99599"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99600"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99601"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99602"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:99603"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-91151"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478404"}, {"source": "secalert@redhat.com", "url": "https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"}, {"source": "secalert@redhat.com", "url": "https://github.com/cockpit-project/cockpit/releases/tag/372"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "cockpit: Cockpit: Local privilege escalation via insecure symlink handling in public key addition helper", "id": "2478404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478404"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-59", "details": ["A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."], "name": "CVE-2026-91151", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-base-rhel10", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-base-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/udi-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-11-10T23:59:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91151\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91151\nhttps://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23\nhttps://github.com/cockpit-project/cockpit/releases/tag/372"], "statement": "This Important flaw in Cockpit's `ssh-add-public-key.sh` helper allows a local authenticated user to escalate privileges. By manipulating symlinks within their home directory, an attacker can redirect privileged filesystem operations performed by the helper during the \"Add public key\" workflow in a privileged Cockpit session. This can lead to arbitrary ownership and mode changes on sensitive files, resulting in integrity, confidentiality, and availability impacts. Exploitation requires user interaction and a privileged execution context, preventing unauthenticated or remote attacks.", "threat_severity": "Important"}

{"created": "2026-11-12T22:00:09.862715+00:00", "updated": "2026-11-12T22:00:09.862718+00:00", "vendors": []}