DEBIAN-CVE-2026-4631

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-4631
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4631.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-4631
Upstream
  • CVE-2026-4631
Published
2026-04-07T17:16:38.010Z
Modified
2026-05-16T14:04:28.141488Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.

References

Affected packages

Debian:13 / cockpit

Package

Name
cockpit
Purl
pkg:deb/debian/cockpit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
337-1+deb13u1

Affected versions

Other
337-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4631.json"

Debian:14 / cockpit

Package

Name
cockpit
Purl
pkg:deb/debian/cockpit?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
360-1

Affected versions

Other
337-1
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4631.json"