Security updates for cockpit are now available to address a serious flaw affecting Red Hat Enterprise Linux versions nine through ten. Attackers could potentially execute remote code without authentication by exploiting an injection vulnerability within SSH command line arguments. Red Hat Product Security has officially rated this issue as critical because of the high risk it poses to system integrity.

RHSA-2026:7382: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
RHSA-2026:7384: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
RHSA-2026:7383: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
RHSA-2026:7381: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

RHSA-2026:7382: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

An update for cockpit is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

RHSA-2026:7382: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

RHSA-2026:7384: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

An update for cockpit is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

RHSA-2026:7384: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

RHSA-2026:7383: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

An update for cockpit is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

RHSA-2026:7383: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

RHSA-2026:7381: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection

An update for cockpit is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

RHSA-2026:7381: Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection