{"id":"CVE-2026-92747","aliases":[],"cve":{"records":[{"id":"CVE-2026-92747","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T18:50:18.131Z","published":"2026-09-18T17:53:35.109Z","modified":"2026-11-11T19:08:49.016Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-11T19:08:49.016Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-18T18:02:40.013Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:86970","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:86971","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:98459","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:98562","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-92747","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469260","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469260","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-214","description":"Invocation of Process Using Visible Sensitive Information","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-18T18:02:26.653460Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.","score":5,"severity":"medium","published":"2026-09-18T17:53:35.109Z","modified":"2026-11-11T19:08:49.016Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[{"version":"0:348.1-1.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[{"version":"0:355.1-1.el10_3","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[{"version":"0:348.1-1.el9_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[{"version":"0:355.1-1.el9_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"}],"remediation":[{"text":"Exposure can be reduced by avoiding VM creation or installation flows that supply rootPassword or userPassword while untrusted local users are active on the host, and by using an alternative provisioning method where one is available. Restricting cross-user process inspection on the host, for example by hardening /proc visibility with the hidepid mount option, also limits the ability of other local users to read the install_machine.py command line. These measures reduce the exposure window but do not remove the underlying issue of credentials being passed in process arguments; they should be treated as temporary risk reduction until a fixed cockpit-machines package is available.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"}],"references":["https://access.redhat.com/errata/RHSA-2026:86970","https://access.redhat.com/errata/RHSA-2026:86971","https://access.redhat.com/errata/RHSA-2026:98459","https://access.redhat.com/errata/RHSA-2026:98562","https://access.redhat.com/security/cve/CVE-2026-92747","https://bugzilla.redhat.com/show_bug.cgi?id=2469260"],"sources":[{"name":"CVE","id":"CVE-2026-92747","modified":"2026-11-11T19:08:49.016Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5}],"sourceAffected":[],"observedAt":"2026-11-11T20:38:02.934Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:40:32.870Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-11T20:50:31.578Z","attemptedAt":"2026-11-11T20:50:31.578Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-11T20:50:30.957Z","attemptedAt":"2026-11-11T20:50:30.957Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-11T20:50:30.957Z","attemptedAt":"2026-11-11T20:50:30.957Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-11T20:50:30.957Z","attemptedAt":"2026-11-11T20:50:30.957Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-8p9r-6652-9xc4","url":"https://github.com/advisories/GHSA-8p9r-6652-9xc4","modified":"2026-11-11T12:31:31Z","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-11T20:50:30.957Z"},{"source":"FIRST EPSS","id":"CVE-2026-92747","url":"https://www.first.org/epss/","probability":0.00165,"percentile":0.05793,"date":"2026-11-10","checkedAt":"2026-11-11T20:50:30.957Z"},{"source":"ENISA EUVD","id":"EUVD-2026-83261","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83261","modified":"Nov 11, 2026, 7:08:49 PM","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-11T20:50:30.957Z"},{"source":"NVD","id":"CVE-2026-92747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92747","modified":"2026-11-11T19:17:48.890","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","checkedAt":"2026-11-11T20:50:31.578Z"}],"aiSummary":{"text":"A local attacker with process inspection access can expose guest VM credentials in cockpit-machines. The vulnerability occurs when credentials are passed as a JSON command-line argument during VM creation. Exposure is limited to the installation workflow period.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T20:41:16.299Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92747"}]}}