Issued at: 2026-11-04
Updated at: 2026-11-04
Advisory content derived from Red Hat RHSA-2026:94485, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Moderate: cockpit security, bug fix, and enhancement update
Description
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147)
* cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235)
Bug Fix(es) and Enhancement(s):
* [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:Rocky Linux-246964)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.