CVE WatchJul 15, 2026

CVE-2026-4631

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or s

CVSS

9.8

Critical

EPSS

14.2%

p96

KEV

—

Exploit Today

0-100

Published: Apr 7, 2026 · Last modified: Jul 15, 2026 · CWE-78

EPSS · 30d

14.2%EPSS · 30 days14.2%

2026-06-302026-07-16

Technical description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2d CVE-2024-121210.0 CRI

99.9%

KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability3d CVE-2022-262589.8 CRI

99.6%

KEV—80D-Link DIR-820L Remote Code Execution Vulnerability7d CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability2d CVE-2021-252988.8 HIG

99.5%

KEV—80Nagios XI OS Command Injection7d CVE-2021-252978.8 HIG

98.9%

KEV—80Nagios XI OS Command Injection7d