$ cve CVE-2026-4631 JSON

CVE-2026-4631 EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 9.2% (pctl 95)

Patch early

A public exploit exists.

Description

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	9.22% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	yes
Published	2026-04-07
Last modified	2026-08-04

Public exploits

Source	Title	Date
exploit-db	Cockpit 359 - RCE	2026-05-21

References

→ the Explorer · watch your stack · NVD